VULNpocalypse
MediumBreach / campaignOngoing

Norad grants portal breach exposes names and emails of 20,614 users

Attackers used 27 compromised accounts to reach Norad’s grants portal, so registered users should watch for phishing and secure their logins.

Published
Exploitation
Yes, Norad says attackers logged in with 27 compromised user accounts and took portal data

What happened

Norad, the Norwegian Agency for Development Cooperation, disclosed that attackers accessed its Grants Portal. Norad and Norway’s Ministry of Foreign Affairs use the portal to collect funding applications for aid projects (Help Net Security).

  • Users affected: the portal has been in use since 2017 and has 20,614 registered users from 12,511 organizations. Norad says the names and email addresses of all of them may have been taken (Help Net Security). The Register describes the data of all registered users as stolen (The Register).
  • How they got in: the attackers logged in with 27 compromised user accounts. Norad contacted the owners of those accounts (Help Net Security). How those accounts were compromised is not confirmed.
  • Detection: the intrusion was discovered on 30 October. How long the attackers had access is not confirmed (The Register).
  • Application data: applications and supporting documents from three organizations based outside Norway were taken. Norad says more organizations may turn out to be affected (Help Net Security). The Register quotes Norad as saying this information was “misdirected” (The Register).
  • Sensitive applicants: Norad cannot rule out that the attackers saw the names of applicants working in conflict zones and authoritarian states (Help Net Security).
  • Attribution: Norad says it does not know who is behind the attack. The Norwegian National Security Authority (NSM) said the attack shares characteristics with other recent cyberattacks, but those attacks were not named (Help Net Security).
  • Response: Norad set up a crisis team and is engaging external cybersecurity experts. It reported the incident to the police, the Norwegian Data Protection Authority (Datatilsynet) and NSM, and it is notifying affected users and organizations (Help Net Security).

The two outlets differ on whether the portal is available. Help Net Security quotes Norad’s Torger Kjeldstad saying the portal “was closed down immediately” (Help Net Security). The Register quotes him saying “it should be safe” to continue using Norad’s services (The Register).

Am I affected?

  • If you are a registered user of the Norad Grants Portal, Norad says your name and email address may have been taken (Help Net Security).
  • If your organization submitted applications through the portal, Norad has so far confirmed that three organizations’ documents were taken and says more may be found (Help Net Security).
  • If you own one of the 27 accounts used in the attack, Norad says it has already contacted you (Help Net Security).

Whether passwords or other credentials were exposed is not confirmed.

What to do now

The sources do not list specific steps Norad has asked users to take. The steps below are general precautions, not Norad guidance.

  1. Watch for a notification from Norad. The agency says it is notifying all 20,614 registered users and the affected organizations (Help Net Security).
  2. Change your portal password when the portal is available. Change it anywhere else you used the same password.
  3. Be cautious with emails that mention Norad, grants or your application, because names and email addresses were exposed. Check any requests through a channel you already know is genuine.
  4. If your organization works in a conflict zone or an authoritarian state, consider whether exposure of your name or application changes your risk. Contact Norad for details.
  5. Check Norad’s statement for updates. The agency says it will update the statement as the investigation continues (Help Net Security).

Sources