Cyberattack on Norway’s aid agency may have swept up all user data
A regulator has issued a formal reprimand against Norway’s aid agency, without a fine attached.
A regulator has issued a formal reprimand against Norway’s aid agency, without a fine attached.
The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed.
Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid.
Our digital services must be safe to use, and we will do everything we can to get to the bottom of what has happened, Kjeldstad added.
The intruders also stole applications and supporting documents submitted by three organizations based outside Norway, though the agency warned that others could turn out to be affected.
Norad added that it cannot rule out that the attackers saw the names of applicants who operate in conflict zones and authoritarian states.
Any organization in the same sector or handling data the same way Norway’s aid agency does is now looking at the same regulatory standard, not just Norway’s aid agency.
According to the agency, the portal has been in use since 2017 and has 20,614 registered users representing 12,511 organizations worldwide, which means every one of those users may be affected.
The perpetrators got in by logging in with 27 compromised user accounts, and Norad contacted the owners of those accounts on Tuesday.
A regulatory finding like this is a signal to the whole sector, not just the named organization: this is the standard that's now being enforced, not just discussed.
While we have a good understanding of the incident, we are engaging external cybersecurity experts to ensure we have a complete picture of the attack, a detailed assessment of what information the attackers gained access to. The agency has reported the incident to the police, the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM).
Norway’s aid agency has responded to the finding without a fine being imposed.
Norad is working on notifying the 20,614 registered users and the three organizations it knows were hit.
The agency says it will update its statement as the investigation continues.
Review your own compliance posture against whatever standard this regulator just enforced, since this finding is the clearest signal yet of what actually gets acted on.
Don't assume a reprimand without a fine means low risk -- the finding of fault is what sets the precedent, not the dollar amount.
What happened
A regulator has issued a formal reprimand against Norway’s aid agency, without a fine attached.
The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed.
Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid.
What changed
Our digital services must be safe to use, and we will do everything we can to get to the bottom of what has happened, Kjeldstad added.
The intruders also stole applications and supporting documents submitted by three organizations based outside Norway, though the agency warned that others could turn out to be affected.
Norad added that it cannot rule out that the attackers saw the names of applicants who operate in conflict zones and authoritarian states.
Who is affected
Any organization in the same sector or handling data the same way Norway’s aid agency does is now looking at the same regulatory standard, not just Norway’s aid agency.
According to the agency, the portal has been in use since 2017 and has 20,614 registered users representing 12,511 organizations worldwide, which means every one of those users may be affected.
The perpetrators got in by logging in with 27 compromised user accounts, and Norad contacted the owners of those accounts on Tuesday.
Why it matters
A regulatory finding like this is a signal to the whole sector, not just the named organization: this is the standard that's now being enforced, not just discussed.
While we have a good understanding of the incident, we are engaging external cybersecurity experts to ensure we have a complete picture of the attack, a detailed assessment of what information the attackers gained access to. The agency has reported the incident to the police, the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM).
Response
Norway’s aid agency has responded to the finding without a fine being imposed.
Norad is working on notifying the 20,614 registered users and the three organizations it knows were hit.
The agency says it will update its statement as the investigation continues.
What security teams should do
Review your own compliance posture against whatever standard this regulator just enforced, since this finding is the clearest signal yet of what actually gets acted on.
Don't assume a reprimand without a fine means low risk -- the finding of fault is what sets the precedent, not the dollar amount.