[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fe1aGifDaVaMG0QaNo79e3pV-OEcEGi3V8EkS5GSnUMs":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c578ca00-08b8-4433-8dbe-ab3a0eca0e27","Cyberattack on Norway’s aid agency may have swept up all user data","cyberattack-on-norway-s-aid-agency-may-have-swept-up-all-user-data-41a3eb","The names and email addresses of 20,614 people registered on Norad’s Grants Portal may have ended up in the hands of attackers, Norway’s development aid agency has disclosed. Norad, short for the Norwegian Agency for Development Cooperation, works with partners around the world on development aid. It operates the portal, and both the agency and Norway’s Ministry of Foreign Affairs use it to collect funding applications for aid projects. According to the agency, the portal … More → The post Cyberattack on Norway’s aid agency may have swept up all user data appeared first on Help Net Security.","Norway's development aid agency, Norad, has disclosed a cyberattack on its Grants Portal, potentially compromising the names and email addresses of all 20,614 registered users. The attackers gained access using 27 compromised user accounts and also stole funding applications and supporting documents from three organizations. The agency is working with external cybersecurity experts and has reported the incident to authorities.","Norway's aid agency Norad discloses cyberattack potentially exposing data of 20,614 users.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F05\u002Fnorad-grants-portal-breach\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2023\u002F07\u002F25122008\u002Fnorway.jpg","2026-11-05T13:56:49+00:00","2026-11-05T14:00:21.959199+00:00",7,[17,20],{"name":18,"type":19},"Norad","vendor",{"name":21,"type":22},"Grants Portal","product","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"malware","compromised user accounts","Attackers gained access by logging in with 27 compromised user accounts.",[18,21],{"controls":48,"vendors":132},[49,78,104],{"slug":50,"name":51,"problem":52,"products":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,88,96],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":84,"product_name":85,"url":86,"description":87},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":105,"name":106,"problem":107,"products":108},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[109,117,124],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"databahn","DataBahn","\u002Fvendor-logos\u002Fdatabahn.png","databahn-data-pipeline","DataBahn Data Pipeline","https:\u002F\u002Fwww.databahn.ai\u002Fproducts\u002Fdata-pipeline","Collection at the edge, transformation and routing of security data to SIEMs and data lakes, with an AI agent for managing the pipelines.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":119,"url":122,"description":123},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":145},"compromised-user-accounts-enable-mass-data-breach-at-norways-aid-agency","Compromised User Accounts Enable Mass Data Breach at Norway's Aid Agency","Attackers gained entry to Norad's Grants Portal by leveraging 27 compromised user accounts, ultimately exposing personal data for over 20,000 registered users. This highlights how credential compromise — likely through phishing or reuse of stolen passwords — can bypass perimeter defenses when multi-factor authentication is absent or poorly enforced. The breach also resulted in the theft of sensitive funding applications, demonstrating that over-permissioned user accounts can enable lateral data access well beyond the initial entry point. Organizations handling sensitive third-party data must treat identity and access hygiene as a frontline defense, not an afterthought.",[138,139,140,141,142,143,144],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"GDPR Article 32":146,"NIS2 Article 21(2)(b)":147,"MITRE ATT&CK T1566: Phishing":148,"CIS Control 6: Access Control Management":149,"CIS Control 17: Incident Response Management":150,"CIS Control 14: Security Awareness and Skills Training":151,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":152},"Norad processes personal data of thousands of individuals; Article 32 requires appropriate technical measures — including access controls and encryption — to protect that data, obligations that were evidently insufficient here.","NIS2 mandates incident handling and access control measures for entities managing critical or sensitive digital infrastructure; Norad's portal handling aid funding data likely falls within scope, requiring stronger protective controls.","The 27 compromised accounts are consistent with a phishing-based credential harvesting campaign; recognizing and mitigating this initial access technique is directly relevant to preventing this breach.","Applying least-privilege access and promptly disabling compromised accounts — core CIS Control 6 practices — would have limited how much data the attackers could reach once inside the portal.","Norad's engagement of external cybersecurity experts after the fact suggests a reactive posture; a pre-established incident response plan under CIS Control 17 would have enabled faster containment and reduced the scope of data exposure.","Credential compromise is frequently the result of phishing or password reuse; regular, targeted training for both staff and external portal users would reduce the likelihood of accounts being successfully compromised.","The attackers exploited 27 compromised accounts, indicating insufficient authentication controls; enforcing MFA and strong identity verification under PR.AA would have significantly raised the barrier to unauthorized access."]