Norad Grants Portal Breach Exposes Data of 20,614 Registered Users via Compromised Accounts
Norway's development aid agency Norad disclosed that attackers compromised 27 user accounts to breach its Grants Portal, potentially exposing names and email addresses of all 20,614 registered users representing 12,511 organizations worldwide. The intrusion was discovered on 30 October 2026, prompting Norad to shut down the portal immediately. Attackers also stole full applications and supporting documents from three organizations based outside Norway, with Norad warning additional victims could be identified as the investigation continues. The agency noted it cannot rule out that attackers accessed names of applicants operating in conflict zones and authoritarian states, raising serious safety concerns for vulnerable individuals and organizations.
Detalhes técnicos
The attackers gained initial access by logging in with 27 compromised user accounts, rather than exploiting a technical vulnerability in the portal itself. Norad has engaged external cybersecurity experts alongside its internal crisis management team to fully scope the incident. Norway's National Security Authority (NSM) confirmed the attack shares characteristics with other recent cyberattacks, though specifics were not disclosed.
Remediação
Norad has taken the Grants Portal offline, notified owners of the 27 compromised accounts, and reported the incident to police, the Norwegian Data Protection Authority (Datatilsynet), and NSM. The agency is in the process of notifying all 20,614 registered users and the three confirmed affected organizations, and has committed to publishing updates as the investigation progresses.
Linha do tempo
-
Norad Grants Portal Breach Exposes Data of 20,614 Registered Users via Compromised Accounts
ler a análise desta fonte ocultar
Norway's development aid agency Norad disclosed that attackers compromised 27 user accounts to breach its Grants Portal, potentially exposing names and email addresses of all 20,614 registered users representing 12,511 organizations worldwide. The intrusion was discovered on 30 October 2026, prompting Norad to shut down the portal immediately. Attackers also stole full applications and supporting documents from three organizations based outside Norway, with Norad warning additional victims could be identified as the investigation continues. The agency noted it cannot rule out that attackers accessed names of applicants operating in conflict zones and authoritarian states, raising serious safety concerns for vulnerable individuals and organizations.
Technical Details
The attackers gained initial access by logging in with 27 compromised user accounts, rather than exploiting a technical vulnerability in the portal itself. Norad has engaged external cybersecurity experts alongside its internal crisis management team to fully scope the incident. Norway's National Security Authority (NSM) confirmed the attack shares characteristics with other recent cyberattacks, though specifics were not disclosed.
Remediation
Norad has taken the Grants Portal offline, notified owners of the 27 compromised accounts, and reported the incident to police, the Norwegian Data Protection Authority (Datatilsynet), and NSM. The agency is in the process of notifying all 20,614 registered users and the three confirmed affected organizations, and has committed to publishing updates as the investigation progresses.