Norway’s development agency Norad has confirmed that attackers broke into its Grants Portal and stole the names and email addresses of all 20,614 registered users. The users belong to 12,511 organizations, and the agency said it cannot be sure the details of people in conflict areas and authoritarian states are safe.
What Attackers Took From the Norad Grants Portal
Norad, the Norwegian Agency for Development Cooperation, said the portal, which launched in 2017, was breached and the full user base was affected. The stolen data consists of names and email addresses.
Beyond the user list, application information from at least three organizations was taken. The Register describes that information as “misdirected” and says more may be found. Cybernews reports the intruders stole information from at least three organizations’ grant applications.
27 Abused Accounts as the Entry Route
According to Cybernews, the attackers got in by compromising and abusing 27 user accounts. The reports do not say how those accounts were compromised, and the attacker has not been identified.
Torger Kjeldstad, Norad’s director of digitalization, called the attack “complex.” The agency started a crisis team and is bringing in external cybersecurity experts to establish exactly what was accessed.
Risk to Aid Recipients in Sensitive Regions
The most pressing concern the agency raised involves people it could not guarantee were safe. Norad said it cannot be certain whether details of individuals in “conflict areas and authoritarian states” remain protected. Grant applicants working in such regions can face risk if their involvement with a foreign aid agency becomes known.
Conflicting Accounts of Portal Availability
The Register notes that Norad said continued use of its services “should be safe” while the investigation continues. Cybernews, however, reports that the portal was taken offline. The sources do not reconcile the two statements, and the current availability of the service remains unclear.
Norad Notifies Users and Norwegian Authorities
Norad said notifications to users and to the three affected organizations are under way. Norwegian privacy, security and police authorities have been informed of the incident.
The agency publicly confirmed the breach on Nov. 5. It has not provided a date for when the intrusion began or when it was detected, and no group has claimed responsibility.
Scope of the Exposed User Base
Because every registered user is covered, the breach touches the entire portal community and not a subset. With 12,511 organizations involved, the exposed email addresses could connect the agency to a wide range of grant recipients and applicants. Names and email addresses are limited data types, but together with organization affiliation they identify who works with Norwegian development funding.
What Norad Has Not Yet Established About the Breach
Norad’s investigation is still working out what the attackers accessed beyond the user list and the three organizations’ applications. The agency has not said whether payment details, project budgets or attached documents were included in the application material that was taken, and the sources reviewed do not describe the content of the applications.
Norad has not said whether the 27 compromised accounts had broad permissions or how the attacker obtained their credentials.
For the three organizations whose applications were taken, notification is already in progress. For the remaining users, the confirmed exposure is limited to names and emails, though the agency has stopped short of promising that nothing further was accessed.
Norad’s Crisis Team and Outside Forensic Experts
Norad said it started a crisis team and is bringing in external cybersecurity experts to establish exactly which data the attackers reached. Torger Kjeldstad’s description of the attack as “complex” suggests the agency does not yet regard the incident as fully understood.
Notifications to users and to the three organizations are under way, and the privacy, security and police authorities in Norway have been told.
