Norad grants portal breached via 27 compromised accounts; data of all 20,614 registered users stolen
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 06/11/2026 12:06; os links antigos trazem para cá.
Norway's development aid agency Norad confirmed that attackers used 27 compromised user accounts to break into its Grants Portal and stole the names and email addresses of all 20,614 registered users from 12,511 organizations (theregister.com, helpnetsecurity.com). The intrusion was detected on 30 October 2026, and how long the attackers had access is still unclear (theregister.com). Full applications and supporting documents were also taken from three organizations based outside Norway, and Norad warns that more victims may be identified (helpnetsecurity.com, theregister.com). Norad cannot rule out that the stolen names include applicants in conflict zones and authoritarian states, which poses a safety risk. The agency has not attributed the attack. The latest report (helpnetsecurity.com, 5 November 2026) says the portal was taken offline and that notification of all registered users is under way.
Detalhes técnicos
- Attackers logged in with 27 compromised user accounts rather than exploiting a vulnerability in the portal (helpnetsecurity.com). How those credentials were obtained has not been disclosed.
- The portal has been operational since 2017 and handles applications from organizations worldwide. These include support for independent journalism in Moldova, aid for Ukrainian children and POWs, and humanitarian work in Gaza (theregister.com).
- Norway's National Security Authority (NSM) said the attack shares characteristics with other recent cyberattacks, without giving details (helpnetsecurity.com).
- Norad has not attributed the attack to any actor (theregister.com).
- Norad has engaged external cybersecurity experts and an internal crisis team to determine the full scope of the stolen data.
Remediação
- Norad took the Grants Portal offline on discovery, notified the owners of the 27 compromised accounts, and reported the incident to police, the Datatilsynet (Norwegian Data Protection Authority) and NSM (helpnetsecurity.com).
- The agency is notifying all 20,614 registered users and the three confirmed affected organizations, and has promised updates as the investigation proceeds (helpnetsecurity.com).
- Organizations and individuals who applied through the portal should treat their names and email addresses as exposed and expect targeted phishing. Anyone working in high-risk regions should assess personal safety risks.
- Defenders should reset credentials and enforce multi-factor authentication on portal accounts and on any other service where the same passwords were used. This is general guidance, not stated in the sources.
Relatos divergentes
- Notification: theregister.com said it was not confirmed whether or when affected users would be notified individually. The later helpnetsecurity.com says notification of all 20,614 users and the three organizations is in progress, so the latter is more current.
- Portal status: theregister.com said Norad considers its services safe to use during the investigation. helpnetsecurity.com says the portal was shut down immediately and taken offline.
- Initial access: theregister.com said the method was not specified. helpnetsecurity.com says it was logins with compromised accounts, not a software flaw.
- Affected organizations: theregister.com said grant data from at least three organizations was exposed. helpnetsecurity.com specifies three organizations outside Norway whose full applications and documents were stolen.
Linha do tempo
-
Norad Grants Portal Breach Exposes Data of 20,614 Registered Users via Compromised Accounts
ler a análise desta fonte ocultar
Norway's development aid agency Norad disclosed that attackers compromised 27 user accounts to breach its Grants Portal, potentially exposing names and email addresses of all 20,614 registered users representing 12,511 organizations worldwide. The intrusion was discovered on 30 October 2026, prompting Norad to shut down the portal immediately. Attackers also stole full applications and supporting documents from three organizations based outside Norway, with Norad warning additional victims could be identified as the investigation continues. The agency noted it cannot rule out that attackers accessed names of applicants operating in conflict zones and authoritarian states, raising serious safety concerns for vulnerable individuals and organizations.
Technical Details
The attackers gained initial access by logging in with 27 compromised user accounts, rather than exploiting a technical vulnerability in the portal itself. Norad has engaged external cybersecurity experts alongside its internal crisis management team to fully scope the incident. Norway's National Security Authority (NSM) confirmed the attack shares characteristics with other recent cyberattacks, though specifics were not disclosed.
Remediation
Norad has taken the Grants Portal offline, notified owners of the 27 compromised accounts, and reported the incident to police, the Norwegian Data Protection Authority (Datatilsynet), and NSM. The agency is in the process of notifying all 20,614 registered users and the three confirmed affected organizations, and has committed to publishing updates as the investigation progresses.
-
Norway's Aid Agency Norad Breached, Data of All 20,614 Grant Portal Users Stolen
ler a análise desta fonte ocultar
Norad, Norway's national aid agency, confirmed that attackers compromised 27 accounts to gain access to its grant portal, exfiltrating names and email addresses of all 20,614 registered users across 12,511 organizations. Grant application data from at least three organizations was also exposed, with Norad warning the number could grow as the investigation continues. The intrusion was detected on October 30, 2026, though the duration of attacker access remains unclear. Norad has not disclosed the initial access method or attributed the attack, and has engaged external cybersecurity experts to determine the full scope of compromised data. Of particular concern is the possibility that names of applicants located in conflict zones and authoritarian states may be among the stolen records, posing potential safety risks.
Technical Details
The attackers used 27 compromised accounts to access the grant portal, which has been operational since 2017 and manages applications from organizations worldwide, including support for independent journalism in Moldova, aid for Ukrainian children and POWs, and humanitarian efforts in Gaza. Norad has not specified the initial access vector or techniques used.
Remediation
Norad has established a crisis team and is working with external cybersecurity experts to fully assess the scope of the breach. The agency states its services remain safe to use while the investigation continues, though it has not confirmed when or if affected users will be individually notified.