← All resources

Outage of KOMBIT's shared municipal support systems on 7 October 2026

2026-10-12 · incident-report · supply-chain

On Wednesday 7 October 2026, staff across Danish municipalities could not reach KOMBIT's shared municipal support systems, including the shared login, for more than five hours. KMD, which runs the systems for KOMBIT, said the cause was a fault in the network to its datacentres, which a subcontractor runs, and that it was not a cyberattack.

On the afternoon of Wednesday 7 October 2026, municipalities across Denmark lost access to KOMBIT's shared municipal support systems (Fælleskommunale Støttesystemer), the common infrastructure that municipal systems rely on for, among other things, access control. KOMBIT's press chief said the fault probably affected all municipalities. KMD, which runs the systems for KOMBIT, said they kept running throughout, but a network fault cut users off from the datacentres they run in. The systems were reported back around 21:00, more than five hours after the first reports.

All times are Danish time (CEST, UTC+2).

Timeline

TimeWhat happenedSource
about 15:30KOMBIT receives the first reports of problems.KOMBIT's press chief, to DR and TV 2 Øst
15:34An incident on the shared support systems is created on KOMBIT's status page.KOMBIT status page (time the incident record was created)
17:20A second notice on the same page, from DataGruppen MultiMed, warns that hospital stay notices through Sundhedsagenten may be unavailable, and names problems with the shared access control, the Security Token Service (STS).KOMBIT status page
20:27The support-systems incident is closed with normal operation restored. The notice is signed by STS Support from a kmd.dk address.KOMBIT status page
20:33MultiMed reports that the problems with STS continue for its integration.KOMBIT status page
about 20:50KMD says all systems should be working again.KMD, to TV 2
about 21:00The systems are reported running again in the municipalities.TV 2 Nord
21:50MultiMed reports Sundhedsagenten back to normal, with its queue of notices cleared.KOMBIT status page
about 22:00KMD gives its written explanation of the cause (below).KMD, to TV 2

What Failed

KOMBIT is responsible for the shared municipal infrastructure on behalf of Denmark's municipalities. It is the layer that connects municipal systems and gives them common services such as access control, user management, organisation data and message distribution. Notices about the support systems on KOMBIT's status page are signed by STS Support with a kmd.dk address, and KMD said the outage was its responsibility.

On 7 October, users could not reach the support systems. A notice from another supplier on the same status page named the shared access control for systems, Fælleskommunal Adgangsstyring for systemer (the Security Token Service), as the source of its problems, and KOMBIT's press chief told DR that municipalities had trouble logging in through the central access control.

One downstream effect was published on KOMBIT's status page. Sundhedsagenten, from DataGruppen MultiMed, warned that hospital stay notices (the SF0810 Sygehusophold integration) could be unavailable altogether, so users might not receive notice of a citizen's hospital stay. It reported normal operation at 21:50, after the support systems themselves were back and its queue had been processed.

Impact as Publicly Reported

  • KOMBIT's press chief told TV 2 that the fault probably affected all municipalities, and TV 2 Nord and TV 2 Østjylland reported that all of them were hit. In the evening, DR wrote that it was still unclear how many municipalities had been hit, and how badly.
  • KMD said the impact varied with the systems each municipality uses.
  • Home care was the most reported effect. TV 2's live coverage, citing TV 2 Øst, reported that home care staff could not reach the systems that show which citizens they were due to visit. In Frederikshavn, DR reported, home care staff had trouble reaching patient records, and the municipality switched to its emergency procedures, including an emergency report of the day's visit lists.
  • KMD said it set up an emergency login so home care staff could sign in through their municipality's own login while the shared login was down. Guldborgsund Kommune said its staff were shown another way into the journal systems.
  • Effects differed between municipalities. Aarhus Kommune said its records-management (journalisering) system had been hard to reach, but home care was not affected. Favrskov Kommune said its records-management, finance and payroll systems were down for about four hours, until about 19:30. Computerworld reported that several municipalities waited about six hours.
  • Hospital stay notices through Sundhedsagenten could be unavailable until late evening (above).

The Cause, as KMD Stated It

In a written reply to TV 2 that evening, KMD:

  • said the outage was its responsibility;
  • said the fault was in the network to its datacentres, which a subcontractor runs, and that the systems kept running but users could not reach them;
  • called it a technical fault, not a cyberattack;
  • said there was no risk of data loss or a security breach, and that systems and data stayed intact;
  • said it was investigating the cause.

KMD did not name the subcontractor. KOMBIT said it was analysing the incident to prevent it from happening again.

Reading KOMBIT's Status Page

  • No level. KOMBIT's status page shows an incident's level only while it is open, through the state of the components it affects, and drops those components when the incident closes. Both 7 October notices had closed before Resiliate began reading the page, so the level they showed while open, if any, cannot be recovered. Resiliate shows both without a level rather than guess one.
  • No start time. The page's incident history now shows each notice as closed, with the time of its last update (20:27 for the support systems). The start times above come from the creation time stored in each incident's identifier, not from anything the page shows.
  • Two notices, one outage. The support-systems notice and the Sundhedsagenten notice describe the same event, posted by two different suppliers.
  • No status page of KMD's own. Resiliate has not found a public status page from KMD; notices about these systems appear on KOMBIT's page.

The Dependency Chain

The fault sat several links away from the municipalities that felt it:

  1. The municipalities use KOMBIT's shared systems.
  2. KOMBIT is responsible for the shared infrastructure on their behalf.
  3. KMD runs the support systems for KOMBIT.
  4. KMD's subcontractor runs the network to KMD's datacentres, where KMD said the fault was.

Other suppliers depend on the same systems without being links in that chain: Sundhedsagenten relies on the shared access control, which is why hospital stay notices were affected.

The chain is changing. On 10 August 2026 KOMBIT signed a 12-year contract with Aeven to build and run a new shared operations platform, and the support systems are the first due to move to it. KOMBIT has not published a date for the move.

Sources