The Norwegian Refugee Council said it suffered a significant cyber attack that compromised the sensitive personal information of thousands of project participants.
The Norwegian Refugee Council (NRC) said on 13th July that the cyber security incident affected an online database that contained information about project participants. Immediately after identifying the incident, the NRC took steps to mitigate the situation and protect the information stored in the database.
“As soon as we became aware of this breach, we took immediate action to suspend the online database in order to safeguard the personal information and prevent further attacks,” NRC said.
Based in Oslo, Norway, the Norwegian Refugee Council has a staff of over 5,000 people and provides humanitarian aid to displaced people who are forced to flee their homes as a result of conflict, human rights violations, and acute violence, as well as climate change and natural disasters.
The humanitarian NGO said it has launched an investigation with assistance from external forensic experts to understand the nature and scope of the cyber attack. It also promised to enhance the security of the data it possesses and provide support to all individuals who may have been affected by the incident.
“Safeguarding the data of our project participants is of paramount importance to us, and we strive to do everything possible to protect it. The personal information of vulnerable people in need of humanitarian assistance must never be targeted,” NRC added.
The Oslo-based humanitarian non-governmental organisation is yet to share details on how the threat actors infiltrated its internal network or if any data has been compromised.
This is not the first time a humanitarian organisation has been targeted by threat actors. In January last year, the International Committee of the Red Cross (ICRC) announced that it suffered a significant cyber security incident that compromised the personal data and confidential information of more than 515,000 highly vulnerable people.
The affected people included victims of migration, disaster, and conflict, those in detection, and people who went missing and their families. ICRC also revealed that the stolen data originated from at least 60 Red Cross and Red Crescent National Societies globally.
ICRC said that what concerned it the most was that the leaked data, which could be shared publicly, belonged to members of a programme called Restoring Family Links that sought to reunite family members separated by conflict, disaster, or migration. As a result of this cyber attack, ICRC had to temporarily shut down the systems used to run the programme.
