Norway's aid agency pwned and all users' data is stolen

Nor­way's na­tio­nal aid agency, Norad, has con­fir­med that cyber cri­mi­nals broke into its sys­tems, stea­ling in­for­ma­tion about each and every re­gis­te­red user of its grant por­tal. Norad, which coor­di­na­tes Nor­way's as­sis­tan­ce for fo­reign de­ve­lop­ment, said that 20,614 re­gis­te­red in­di­vi­duals had their names and email ad­dres­ses swi­ped, and in­for­ma­tion from at least three or­ga­ni­za­tions' ap­pli­ca­tions was "mis­di­rec­ted." The agency cla­ri­fied that the grant por­tal, which was laun­ched in 2017, has 20,614 re­gis­te­red users, mea­ning all were af­fec­ted, across 12,511 or­ga­ni­za­tions. In ad­di­tion, the grant ap­pli­ca­tions for at least three or­ga­ni­za­tions are con­fir­med to be in­vol­ved, though Norad said it may dis­co­ver more as its in­ves­ti­ga­tion con­ti­nues. Tor­ger Kjelds­tad, di­rec­tor of di­gi­ta­li­za­tion at Norad, said "the at­tack is com­plex," and con­fir­med the agency has initia­ted a cri­sis team to ma­na­ge it. "We know a lot about what has hap­pe­ned, but to en­su­re that we have a com­ple­te over­view of the at­tack, we are wor­king to en­ga­ge ex­ter­nal ex­perts in cy­ber­se­cu­rity," he said. "They will give us a de­tai­led des­crip­tion of what in­for­ma­tion those who at­tac­ked the so­lu­tion have gai­ned ac­cess to." Kjelds­tad added that "it should be safe" to con­ti­nue using Norad's ser­vi­ces while it con­ti­nues to probe what hap­pe­ned, and who was behind it. Norad did not re­veal many de­tails about how the at­tack un­fol­ded, other than sa­ying that 27 ac­counts were com­pro­mi­sed and were then used to gain ac­cess to the por­tal and the data in ques­tion. The agency said the in­tru­sion was de­tec­ted on Oc­to­ber 30, but did not offer any in­di­ca­tion as to how long the at­tac­kers re­tai­ned ac­cess to the grant por­tal. It also re­fu­sed to rule out that names of ap­pli­cants in "con­flict areas and autho­ri­ta­rian sta­tes" may have been in­clu­ded in the sto­len data – it is not known if re­ci­pients would have also been re­gis­te­red users – and said it is ap­proa­ching the mat­ter "very se­riously." The grant por­tal, ma­na­ged by Norad, which itself is part of Nor­way's Mi­nistry of Fo­reign Af­fairs, is res­pon­si­ble for hand­ling ap­pli­ca­tions from or­ga­ni­za­tions across the world. Re­cent case stu­dies in­clu­de sup­port for in­de­pen­dent, in­ves­ti­ga­ti­ve jour­na­lism in Mol­do­va, a country which rou­ti­nely battles Rus­sian pro­pa­gan­da and elec­tion in­ter­fe­ren­ce, and bac­king for Ukrai­nian chil­dren and pri­so­ners of war. The is­sues Norad and the Nor­we­gian go­vern­ment sup­port, ho­we­ver, are wide-ran­ging – from ac­cess to health­ca­re for trans­gen­der peo­ple world­wi­de and Ken­yan in­cu­ba­tors for in­no­va­ti­ve trans­port so­lu­tions, to de­li­ve­ring aid to war-torn Gaza. ®…