Cyberattack on Norway’s aid agency may have swept up all user data

The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed.

Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid. It operates the portal, and both the agency and Norway’s Ministry of Foreign Affairs use it to collect funding applications for aid projects.

According to the agency, the portal has been in use since 2017 and has 20,614 registered users representing 12,511 organizations worldwide, which means every one of those users may be affected.

“This is a serious incident,” said Torger Kjeldstad, director of the Department for Digitalisation at Norad.

“The portal was closed down immediately, and we are still working to determine the full extent of the attack. At this stage, we do not know who is behind it. Our digital services must be safe to use, and we will do everything we can to get to the bottom of what has happened,” Kjeldstad added.

Stolen logins opened the door

The intrusion was discovered on 30 October. The perpetrators got in by logging in with 27 compromised user accounts, and Norad contacted the owners of those accounts on Tuesday.

The intruders also stole applications and supporting documents submitted by three organizations based outside Norway, though the agency warned that others could turn out to be affected.

Norad added that it cannot rule out that the attackers saw the names of applicants who operate in conflict zones and authoritarian states.

Outside experts brought in

Norad mobilized its crisis management team to deal with the incident. “The attack is complex. While we have a good understanding of the incident, we are engaging external cybersecurity experts to ensure we have a complete picture of the attack,” Kjeldstad explained, noting that they will provide “a detailed assessment of what information the attackers gained access to.”

The agency has reported the incident to the police, the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM). NSM confirmed that the attack shares characteristics with other recent cyberattacks, though Norad’s statement does not say which ones.

Norad is working on notifying the 20,614 registered users and the three organizations it knows were hit. “It is important for us to inform those affected,” Kjeldstad stressed.

“We view this as an extremely serious matter. It is now critical that we gain a complete understanding of the attack and its potential consequences,” concluded Kjeldstad.

The agency says it will update its statement as the investigation continues.