Criticism of poor IT security in authorities persists

Danish authorities are being heavily criticized for not addressing the shortcomings in protection against possible hacker attacks despite warnings six years ago. The National Audit Office of Denmark, Statsrevisorerne, is urging four critical institutions—Banedanmark, the Danish Emergency Management Agency, the Danish Health Data Authority, and the Ministry of Foreign Affairs—to implement measures for ransomware attack protection. Lack of action has been exposed in inspections done in 2018 and 2021. Neither Udenrigsministeriet, Banedanmark nor Beredskabsstyrelsen have instituted measures vital to restore operations post-attack. CBS cybersecurity lecturer Jan Lemnitzer criticizes the low priority given to IT security and points out the increasing cyberattack threats by state actors, specifically mentioning Russian attacks on NATO and foreign ministries. Furthermore, Sundhedsdatastyrelsen and Banedanmark have not conducted comprehensive risk assessments making it impossible to evaluate and enhance their cybersecurity effectively. Digitalization minister Marie Bjerre has been requested to provide an explanation.