Italian cybersecurity researcher Andrea Mavilla discovered the private phone numbers of Norway’s defense minister Tore O. Sandvik, Military Intelligence Chief Lars Lervik, PST counterintelligence head Beate Gangås, NSM Director Arne Christian Haugstøyl, and National Police Commissioner Håkon Skulstad on the dark web and two Russian internet platforms on November 9-10, 2026. Norwegian newspaper Aftenposten independently verified the numbers were authentic. PST and military intelligence declined to comment. Norwegian defense researchers called the exposure a “threat” and a “warning.”
What Was Found and Where
Mavilla published his findings on Sunday evening, November 9. By Tuesday, he had located an additional number PST chief ,Beate Gangås , and informed Aftenposten, which independently checked all five phone numbers and confirmed they were genuine.
The data was found in two distinct locations: the dark web, and two Russian internet platforms. The specific Russian platforms haven’t been publicly named in available reporting, but their involvement is the detail that shifts this from a data aggregation story into a more serious category. Data circulating on Russian platforms tied to officials of a NATO member state with active frontline exposure to Russian military and intelligence operations isn’t incidentally concerning. It’s the point.
The numbers were private. These weren’t the publicly listed ministerial contact lines on government websites. They were personal mobile numbers , the kind used for direct communication with allied counterparts, government leadership, and secure operational contacts.
Who Andrea Mavilla Is and Why He’s the Right Person to Have Found This
Mavilla is an Italian cybersecurity specialist with a specific track record in finding personal data of senior government officials on dark web and underground platforms. In April 2025, he publicly disclosed that the private data of Italian Prime Minister Giorgia Meloni and President Sergio Mattarella had been exposed through similar channels. That discovery prompted serious attention in Rome.
He found the Norway data using the same type of monitoring , routine surveillance of dark web and Russian-language platforms for government and official names. He found it, reported it to Norwegian police and PST, and provided Aftenposten with supporting materials including email addresses.
The pattern Mavilla is documenting , high-ranking government officials from NATO countries having their private contact details appear on Russian internet platforms , is not unique to Norway. Italian Foreign Minister Antonio Tajani stated on November 7, just three days before Mavilla’s Norway disclosure, that cybercriminals were actively distributing his private data on the dark web.
This is not coincidental timing. The same week sees Italy’s foreign minister and Norway’s entire security leadership structure affected by the same type of exposure.
Why Neither PST Nor Military Intelligence Is Commenting
Both PST (the Police Security Service, Norway’s counterintelligence and domestic security agency) and E-tjenesten (Norwegian Military Intelligence) declined to comment on the published information.
That silence is itself informative. Agencies capable of rapid public denial , when denial is accurate , routinely issue them. The absence of denial, alongside the absence of comment, is the standard posture when an agency is actively investigating and cannot discuss operational details without compromising the investigation.
Norway’s National Security Authority, NSM, did respond, in carefully measured terms: the agency said it was “not dramatic” that contact details of public persons were available online, but specifically warned that the compilation of information could be exploited. That framing matters. NSM isn’t dismissing the incident. It’s making a precise point about aggregation risk , the same risk we’ve covered extensively in looking at how combining partial data points creates targeted attack packages. A phone number alone is one thing. A phone number, confirmed identity, role, and place of work, sitting on a Russian platform, is a targeting profile.
What “A Threat and a Warning” Actually Means
Pål Buværp, a senior researcher at the Norwegian Defence Research Establishment (FFI), was the most direct voice in the coverage. He called the findings “a threat” and “a warning.” He was specific about what Russia has used similar exposure for previously: causing anxiety in targeted officials, making them feel surveilled and vulnerable, and demonstrating awareness of their existence and movements.
This is textbook hybrid warfare tradecraft. Direct physical operations against NATO security officials carry enormous political and diplomatic cost. Demonstrating that you know someone’s private phone number , the number they use to call their family, their colleagues in allied services, the Prime Minister , costs almost nothing, can’t be attributed definitively, and delivers a clear psychological message: we see you, we know how to reach you, and we’re not hiding that fact.
Buværp’s framing connects to a pattern we’ve seen in multiple 2026 incidents. The Berlin government ransomware attack by Rhysida surfaced three weeks before German state elections. The Arizona court breach exposing protective order holders’ home addresses showed how personal contact and location data translates into tangible vulnerability for people who specifically need their whereabouts protected. The Norway case applies the same logic to senior security officials in a NATO country with direct border exposure to Russia.
The Russia-Norway Security Backdrop
This disclosure doesn’t happen in a vacuum. Defense Minister Sandvik has been among the most active voices in Norwegian government on Russian threats to critical infrastructure. In April 2026, he made a formal statement about Russia’s GUGI (Main Directorate of Deep-Sea Research) conducting operations in Norwegian and British maritime areas , activities Norway assessed as reconnaissance and potential sabotage preparation against undersea infrastructure. Norway has since increased defense spending significantly and deployed assets alongside British allies to monitor Russian movements.
Sandvik is not a low-profile figure in the Norway-Russia dynamic. He is the official overseeing Norway’s direct defense response to Russian military activity. His private phone number appearing on Russian platforms weeks after a period of active Norwegian-Russian maritime confrontation is not a background security concern. It is specifically targeted.
Norway is not the only Nordic NATO member dealing with this category of threat. The pattern across 2025-2026 includes sustained Russian hybrid operations against Baltic states, Swedish and Finnish NATO integration processes, and now Norwegian security leadership. The common thread is personal data being used as a tool of psychological pressure rather than simply financial fraud.
What This Type of Exposure Enables
A private phone number in the wrong hands is not just a harassment risk. For a serving defense minister or intelligence chief, it enables:
Spear phishing: Calls or messages that appear to come from known contacts, using the real personal number as a spoofed sender ID.
SIM swap attacks: Using confirmed personal information alongside a valid phone number to request carrier transfer of the number to an attacker-controlled SIM.
Network mapping: Using the number to identify call patterns, establish regular communication contacts through metadata, and build relationship maps around the target.
Psychological operations: Demonstrating surveillance capability to the official themselves, their staff, and their contacts.
None of these require the data to be “new.” Recycled or compiled data is sufficient for all of them. The NSM’s warning about compilation is precisely this point: individually, any single piece of data looks manageable. Combined with confirmation of identity and role, it becomes operational material.
For anyone wondering how dark web monitoring fits into this picture, it’s the same mechanism that caught the data before Norwegian agencies discovered it themselves , routine surveillance of criminal and foreign-linked platforms by independent researchers like Mavilla, working faster than official channels. It’s the same early-warning function discussed in our piece on why dark web intelligence has moved from optional to essential.
Frequently Asked Questions
Whose phone numbers were leaked?
Defense Minister Tore O. Sandvik, Military Intelligence Chief Lars Lervik, PST Chief Beate Gangås, NSM Director Arne Christian Haugstøyl, and National Police Commissioner Håkon Skulstad.
Where were the numbers found?
On the dark web and two Russian internet platforms, confirmed authentic by Aftenposten.
Who discovered the leak?
Italian cybersecurity researcher Andrea Mavilla, who also previously uncovered similar data exposures involving Italian PM Giorgia Meloni and President Sergio Mattarella in April 2025.
Has Norway confirmed a breach of its own systems?
No. NSM stated contact details of public persons being available is not inherently dramatic, but warned that aggregation of data can be exploited. PST and military intelligence declined to comment.
Why does Russia circulating this data matter?
Senior Norwegian defense researchers at FFI called it psychological warfare — demonstrating surveillance capability, causing anxiety, and establishing vulnerability without taking direct action. Norway is a NATO frontline state actively confronting Russian maritime operations in its waters.
