Norway's aid agency confirms breach of its grant portal, exposing every registered user

Norway's national aid agency, Norad, has confirmed that cyber criminals broke into its grant portal and stole details of every registered user. The portal, launched in 2017, has 20,614 registered users across 12,511 organisations, and all of them had their names and email addresses taken. Grant applications from at least three organisations were also involved, and Norad says it may find more as its investigation continues.

Norad said 27 accounts were compromised and then used to gain access to the portal and the data. The intrusion was detected on October 30, but the agency has not said how long the attackers had access. Torger Kjeldstad, Norad's director of digitalization, called the attack complex and said a crisis team has been set up. The agency is also bringing in external cybersecurity experts to establish exactly what the attackers accessed. He said it "should be safe" to keep using Norad's services during the investigation.

Norad has not ruled out that applicants in "conflict areas and authoritarian states" may be among those affected, and says it is treating the matter "very seriously". It is not known whether recipients in those places were also registered users. The portal handles applications from organisations worldwide, including support for investigative journalism in Moldova and for Ukrainian children and prisoners of war. This article covers only the opening of the original report.