Norway's Norad Agency Breached, All User Data Stolen

Norway's national aid agency, Norad, has confirmed a significant data breach affecting its grant portal, resulting in the theft of personal information belonging to all registered users. The agency, responsible for coordinating Norway's foreign development assistance, disclosed that the names and email addresses of 20,614 individuals were compromised. Additionally, data from at least three organizations' grant applications was "misdirected" during the incident.

The affected grant portal, established in 2017, serves 20,614 registered users across 12,511 organizations. Norad's investigation confirmed that the applications of at least three organizations were involved, with the possibility of more being identified as the inquiry progresses. Torger Kjeldstad, director of digitalization at Norad, described the attack as "complex" and announced the formation of a crisis team to manage the situation.

To gain a comprehensive understanding of the breach, Norad is enlisting external cybersecurity experts. "They will give us a detailed description of what information those who attacked the solution have gained access to," Kjeldstad stated. Despite the ongoing investigation, he advised that it should remain "safe" to continue using Norad's services.

While Norad has not divulged extensive details about the attack's methodology, it was revealed that 27 compromised accounts were exploited to gain unauthorized access to the portal and its data. The intrusion was detected on October 30, but the duration of the attackers' access remains unknown. Norad has not ruled out the possibility that the stolen data includes the names of applicants from "conflict areas and authoritarian states."

The grant portal, managed by Norad under the Norwegian Ministry of Foreign Affairs, plays a crucial role in processing applications from international organizations. These applications support a wide array of initiatives, including independent journalism in Moldova, aid for Ukrainian children and prisoners of war, healthcare access for transgender individuals globally, and innovative transport solutions in Kenya, as well as humanitarian efforts in Gaza.

The breach underscores the persistent threat to sensitive data held by governmental and aid organizations, particularly those involved in international development and support for vulnerable populations. The compromise of user credentials, even if limited to names and emails, can pave the way for further targeted attacks, phishing campaigns, or social engineering attempts against affected individuals and organizations.