Cyberattack on Norway’s aid agency may have swept up all user data
Norway's aid agency Norad discloses cyberattack potentially exposing data of 20,614 users.
Norway's development aid agency, Norad, has disclosed a cyberattack on its Grants Portal, potentially compromising the names and email addresses of all 20,614 registered users. The attackers gained access using 27 compromised user accounts and also stole funding applications and supporting documents from three organizations. The agency is working with external cybersecurity experts and has reported the incident to authorities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Norad?
Get an email when a new story names Norad, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers gained entry to Norad's Grants Portal by leveraging 27 compromised user accounts, ultimately exposing personal data for over 20,000 registered users. This highlights how credential compromise — likely through phishing or reuse of stolen passwords — can bypass perimeter defenses when multi-factor authentication is absent or poorly enforced. The breach also resulted in the theft of sensitive funding applications, demonstrating that over-permissioned user accounts can enable lateral data access well beyond the initial entry point. Organizations handling sensitive third-party data must treat identity and access hygiene as a frontline defense, not an afterthought.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — compromised user accounts