Norway’s development aid agency says intruders who logged in with 27 abused accounts may have seen the names and email addresses of every one of the 20,614 people registered on its Grants Portal. No UK organisation has been named as a victim, but any British charity or NGO that applies to international funders should read this as a warning about its own portal accounts.
What happened
Norad, the Norwegian Agency for Development Cooperation, has confirmed a cyber attack on the Grants Portal it runs for itself and for Norway’s Ministry of Foreign Affairs. The agency discovered the intrusion on 30 October and published a notice on 3 November, which it has since updated. The Register and Help Net Security reported it on 5 November.
According to Norad, the attackers got in by signing in with 27 user accounts that had been compromised and then misused. From there, they may have reached the names and email addresses linked to all 20,614 registered accounts, which belong to 12,511 organisations around the world. Norad has also established that applications and supporting documents from three organisations based outside Norway were taken, and it warns that more organisations could turn out to be affected.
The portal was shut as soon as the attack was found. Norad has stood up its crisis management team, is engaging outside cybersecurity experts, informed the police and notified two national authorities: Norway’s data protection authority, Datatilsynet, and its National Security Authority, NSM. Torger Kjeldstad, Norad’s director of digitalisation, called it “a serious incident”; the culprits are not yet known. According to Norad, NSM has confirmed the attack shares characteristics with other recent intrusions, though Norad has not said which ones.
The owners of the 27 abused accounts were contacted first; notifications to the wider user base and the three known affected organisations are under way.
The detail
On the information released so far, this was not a dramatic exploit. It was a login problem. There is no sign the attackers needed a software flaw to get through the front door; they signed in with compromised accounts belonging to genuine users. Norad has not said how those 27 accounts were compromised, how long the intruders had access before 30 October, or how ordinary user accounts were able to reach data about the entire user base.
That last point is the one I would want answered first. In a well-segmented grants system, an applicant account should see its own organisation’s submissions and very little else. If a handful of applicant logins could be used to enumerate tens of thousands of users, that suggests either an authorisation weakness in the application, an API that returned more than it should, or accounts with broader roles than their owners needed. All are common findings when we test portals of this kind.
Names and email addresses look modest; the context makes them sensitive. The portal ties each person to an aid organisation and, by extension, to the kind of work that organisation applies to fund. Norad says it cannot rule out that the exposed names include applicants working in conflict zones and under authoritarian governments. For those people, being identified as a contact for a foreign-funded project can carry real personal risk.
The portal, live since 2017, takes applications to calls for proposals; Norad notes that UN and other multilateral funding does not pass through it.
Why it matters for UK organisations
To be clear, no UK organisation has been named among the victims, and Norad has not published a breakdown of where its users are based. But the profile of the user base, thousands of development and humanitarian organisations worldwide, overlaps heavily with the UK charity and NGO sector, and many British organisations hold accounts on funder portals run by foreign governments, foundations and multilateral bodies.
Three consequences follow. First, any UK organisation with staff registered on the Norad portal should assume those people’s names and work email addresses may now sit with an unknown attacker. That is ideal raw material for convincing phishing: messages that reference a real funder, a real call for proposals and a real application.
Second, the incident is a reminder that charities’ most sensitive information often lives on platforms they do not control. Application packs can include budgets, bank details, partner lists and the names of field staff. Norad operates the portal, but UK trustees still need to understand what their own people submitted, whether any of it creates a duty to notify staff or partners, and whether the incident meets the Charity Commission’s threshold for serious incident reporting.
Third, UK funders that run their own application portals, from government grant schemes to trusts and foundations, face exactly the same design question. If a small number of compromised applicant logins can expose a whole register of users, that is a governance failure as much as a technical one, and it would interest the ICO under UK GDPR’s security principle.
Expert view
In my experience, grant and supplier portals are among the least tested systems in many organisations. They serve thousands of external users, often sit outside the main identity platform, and usually rely on passwords alone because multi-factor authentication for outsiders is seen as a support burden.
The use of 27 separate accounts is telling. Credential reuse, infostealer logs and targeted phishing all produce batches of valid logins, and attackers increasingly buy or harvest them in bulk rather than hunting for vulnerabilities. Norad has not said which route applied here, and it would be wrong to guess. But a cluster of external accounts suddenly pulling data far outside their normal pattern is exactly what good monitoring should flag.
What to do now
- Check exposure. If your organisation applies to Norad or the Norwegian Ministry of Foreign Affairs, identify every staff member and partner registered on the Grants Portal and watch for Norad’s notification.
- Warn staff about targeted phishing. Brief anyone registered on funder portals to treat unexpected funding, reset or document-request emails with suspicion and to verify through known contacts.
- Reset and separate credentials. Change any password used on the portal and anywhere it was reused. Use a password manager so every external portal has a unique password (Cyber Essentials: user access control).
- Turn on multi-factor authentication wherever funder and supplier portals offer it, and ask those that do not when they will.
- Review what you have submitted to third-party portals, including field staff names and bank details, and minimise it in future.
- Consider reporting duties. Trustees should assess whether to notify affected individuals and partners and whether a serious incident report to the Charity Commission is warranted.
- If you run a portal, test that applicant accounts cannot see other users’ data, monitor for unusual bulk access, and plan for MFA (Cyber Essentials: secure configuration and user access control).
Bottom line
Norad’s breach is a login-led intrusion into a platform that maps thousands of aid workers to the organisations they represent, and the agency itself cannot rule out exposure of people in dangerous places. No UK organisation has been named, but British charities that rely on international funding portals should assume similar systems hold their people’s details, harden their own accounts, and expect well-informed phishing to follow.
