Norad, Norway's agency for development cooperation, has confirmed that attackers broke into its Grant Portal. The portal is the system organisations around the world use to apply for Norwegian aid money. The attackers may have obtained the names and email addresses of all 20,614 registered users, who belong to 12,511 organisations. They also took information from grant applications submitted by at least three organisations outside Norway. Norad says it cannot rule out that the data includes the names of applicants in "conflict areas and authoritarian states." Those are the people the agency's funding is most often meant to protect. The intrusion was detected on 30 October. Norad has closed the portal, reported the case to police, and notified both the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM). No one has said who is behind it.
What Happened
Norad's public statement of 3 November says the attackers used 27 compromised user accounts to get into the Grant Portal. Norad opened the portal in 2017 as the main way for organisations to apply for Norwegian development funding. The agency says it closed the portal "immediately" after discovering the intrusion. It also set up a crisis management team and is bringing in outside cybersecurity experts to establish exactly what the attackers accessed.
"The attack is complex," said Torger Kjeldstad, Norad's Director of Digitalisation. "While we have a good understanding of the incident, we are engaging external cybersecurity experts to ensure we have a complete picture of the attack." He called it "a serious incident."
The Register reports that Norad has not said how long the attackers had access before detection on 30 October. Norad says it told the owners of the 27 hijacked accounts on 2 November. It is now contacting all 20,614 registered users and the three organisations it knows were affected.
Polish outlet o2.pl, citing the Polish Press Agency (PAP) and the Norwegian daily Vårt Land, reports that a grant system run by Norway's Ministry of Foreign Affairs was also attacked, in addition to Norad's portal. Norad is part of the ministry. Norad's own statement mentions only its Grant Portal, and neither Norad nor the ministry has publicly confirmed a separate breach of ministry systems.
On who did it: Norad says it does not know. According to the agency, NSM has confirmed that the attack "shares characteristics with other recent cyberattacks." Neither Norad nor NSM has named those other attacks. The Norwegian security news site ervik.as notes that the incident comes during a period of increased attention to NSM's national risk level and a wave of attacks on Norwegian targets. No public evidence links the Norad breach to any specific campaign.
What Was Taken
Accounts differ on how much was taken and how sure the agency is about it.
- Names and email addresses of all 20,614 portal users. Norad's own statement says the attackers "may have gained access" to this data. The Register's report, based on Norad's disclosures, says the data was stolen. Because the portal has exactly 20,614 registered users, The Register concludes that every account holder is affected.
- Grant application data from at least three organisations. Norad says this data was "extracted" and "compromised." The Register describes it as "misdirected." All three organisations are based outside Norway. Norad says more may turn up as the investigation continues.
- Documents, funding amounts and project goals. o2.pl, citing PAP, goes further. It reports that the stolen material included documents, funding applications, disbursed amounts, and the purposes of projects Norway funds, and says Norad confirmed the theft of data on project goals. It also reports that "several dozen" accounts were used. Norad's statement gives a specific figure of 27. Norad has not publicly confirmed the wider list of stolen material in its English-language statement.
The concern is less about the number of records and more about who is in them. As Mezha and o2.pl both note, Norad funds human rights defenders, independent media and pro-democracy groups, including investigative journalism in Moldova and programmes for Ukrainian children. Some of these organisations work in authoritarian states and conflict zones. Norad told The Register it does not know whether applicants from those regions were also registered portal users, and that it is treating the question "very seriously."
Why It Matters
For most breaches, names and email addresses are low-sensitivity data. Here the context changes that. A list linking named people to organisations that applied for Norwegian money to support democracy, press freedom or human rights effectively shows which people are working with a foreign government. In an authoritarian state, being on that list can lead to surveillance, a "foreign agent" designation, or prosecution. o2.pl notes that exposure could put people working in such places at risk of persecution.
The data is also useful for follow-up attacks. Attackers now know who applies to Norad and, for at least some organisations, what their projects involve. That is enough to write convincing phishing emails posing as Norad, a co-funder, or a partner organisation. Affected organisations should expect this.
There is also a regulatory angle. Under GDPR Article 33, which applies in Norway through the Personal Data Act, a controller must notify Datatilsynet without undue delay and, where feasible, within 72 hours of becoming aware of a breach. If the risk to individuals is high, it must also inform the people affected. Legal guidance from legal247.no notes that the clock starts when the organisation is reasonably certain personal data has been compromised, not when the investigation is finished. Norad says it has notified Datatilsynet but has not published the date it did so. Datatilsynet has not commented publicly.
The incident is part of a recent run of attacks on European public-sector portals. A week earlier, Belgium's federal finance service FOD Financiën took its MyMinfin tax portal offline after a cyberattack. Unlike Norad, the Belgian agency said it had no sign that data was compromised. There is no public evidence connecting the two incidents.
The Attack Technique
Norad has disclosed very little about how the attack worked. What it has confirmed:
- Initial access came through legitimate accounts. The attackers used 27 compromised user accounts to get into the Grant Portal. Norad has not said whether the credentials were phished, reused from earlier breaches, stolen by infostealer malware, or obtained another way. It has also not said whether multi-factor authentication was enforced on those accounts.
- The attackers reached data beyond what those accounts should have seen. If 27 user accounts led to the contact details of all 20,614 users and to other organisations' applications, then either the accounts had unusually broad permissions or the portal had an access-control flaw. Insecure direct object references and over-permissive search or export functions are common causes. This is an inference: Norad has not confirmed either explanation.
- The attack was called "complex." Kjeldstad's description, together with the decision to hire outside responders, suggests more than a single account takeover.
How long the attackers were inside, what tools they used, and whether there was any extortion attempt are all still unknown. No ransomware or data-leak group has publicly claimed the attack.
What Organizations Should Do
- Require phishing-resistant MFA on external-facing portals. Grant, supplier and customer portals often have weaker login security than internal systems. If 27 stolen passwords were enough to get in, that was the weak point. Use passkeys or FIDO2 keys where you can, and at minimum block password-only logins.
- Test the portal's authorisation logic, not just its login. Make sure each user can see only their own organisation's records. Test specifically for enumeration, bulk export, and object-ID manipulation, which are the usual ways one account ends up exposing every user.
- Monitor for unusual account behaviour. Alert on single accounts accessing many records, logins from new locations or infrastructure, and several dormant accounts becoming active together. A group of 27 accounts behaving similarly is the kind of pattern to catch early.
- Classify data by the harm exposure would cause. For organisations that work with civil society, journalists or dissidents, a name plus an affiliation can be life-threatening. Keep that data to a minimum, separate it from general contact data, and plan the breach response around protecting those people, not just around regulatory deadlines.
- Warn affected users about follow-up phishing straight away. If you are a Norad applicant or partner, treat any unexpected email about grants, payments or "account verification" as suspicious. Confirm it through a channel you already know, and change any password you reused on the Norad portal.
- File the regulator notification within 72 hours, then update it. Under GDPR an initial notice can be incomplete, so file it within the deadline rather than waiting for the full forensic picture. Send updates as the investigation progresses.
Sources: Norway's aid agency pwned and all users' data is stolen | Belgium's tax agency confirms cyberattack, pulls services ... | Norad targeted by cyberattack Norad.no | Norad says cyberattack stole grant portal users’ names and email ad... | Poważny cyberatak w Norwegii. W tle dane 20 tys. osób | Personal data breach: the 72-hour deadline | UK considers restrictions on smart glasses amid concerns ... | Norwegian Cold Stores and French Blood Banks Hit by Cooling Attacks...