Supply chain attacks: 282 reports in six months – five questions every nonprofit should ask its suppliers
The Norwegian Data Protection Authority received 282 reports of personal data exposed by deliberate attacks in the first half of 2026, up from 103 in the same period of 2025. A key reason is the supply chain attack: one breach at one supplier hits every customer using the same service. For a nonprofit, that means the board needs to know which suppliers hold member data – and ask them five questions.
- 282 reports of deliberate attacks between January and June 2026, against 103 a year earlier (Datatilsynet, 20 October 2026).
- Q2 2026 is the highest quarter on record in this category, which the authority has tracked since 2023.
- Your organisation reports the breach, even when it is the supplier that was attacked – as a rule within 72 hours of becoming aware of it.
- GDPR Article 28 says you may only use suppliers that provide “sufficient guarantees” about security.
How many attacks were reported to Datatilsynet in the first half of 2026?
According to Datatilsynet, Norway’s data protection authority (20 October 2026), it received 282 reports from organisations saying personal data had been exposed after a deliberate attack. That is the highest first-half figure since the authority began recording the category in 2023, and the second quarter set a new record.
Note that 282 counts reports, not attacks, and that total breach reports are roughly unchanged. A deliberate attack, in Datatilsynet’s definition, is an attempt by outsiders to steal, alter or delete data, or to disrupt operations.
What is a supply chain attack, and why does it hit small organisations?
A supply chain attack is an attack in which the intruder breaks into a service provider and, from there, reaches the data of many customers at once. Datatilsynet cites two 2026 cases: a learning platform used by many educational institutions, and a popular travel-industry service whose breach left hotels reporting exposed guest data.
Small organisations almost always buy ready-made cloud services, so the security of the membership register is decided by the supplier. When a service used by many clubs is hit, many boards face the same problem on the same day.
Who has to report the breach when the supplier is hacked?
This surprises a lot of people: you do. Datatilsynet writes that even when a single supplier is attacked, each organisation using the service is responsible for reporting the breach to the authority.
The deadline is set by GDPR Article 33: a breach must be notified without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to pose a risk to the people concerned. The supplier must notify you without undue delay.
What does GDPR Article 28 mean in plain English?
Under GDPR Article 28(1), the controller may “use only processors providing sufficient guarantees to implement appropriate technical and organisational measures”. In plain English: your organisation may only use suppliers that can show they protect member data well enough – and it is your job to judge that.
Controller and processor
The controller is whoever decides the purpose of the processing and the means used – in a nonprofit, that is the organisation, acting through its board. A processor handles personal data on the controller’s behalf – typically your membership, accounting, newsletter or cloud storage provider.
What is a data processing agreement?
Article 28(3) requires a binding contract between you and the supplier – a data processing agreement. According to Datatilsynet’s guidance on data processing agreements (accessed October 2026), you need one if you use another company’s cloud service to store customer data. It often already sits in the supplier’s standard terms – you just have to find it and file it.
What should a nonprofit ask its membership and accounting software providers?
The questions draw on Articles 28 and 33 and on the joint government guidance on procurement and supplier management at sikkert.no, published by Datatilsynet, the National Security Authority (NSM), Digdir, KS, DFØ and the Norwegian Directorate of Health.
- Do we have a data processing agreement with you, and where is it? Save it in the board’s shared folder.
- Which subcontractors do you use, and where is our data processed? The same obligations must apply all the way down the chain (Article 28(2) and (4)).
- How quickly will you tell us if you are breached – and who will you contact? Agree on a named contact in both directions.
- What security measures do you have, and can you document them? Datatilsynet looks in particular at the supplier’s expertise, reliability and resources. Ask whether two-factor sign-in is available for your users – one of the measures in our security starter pack for small organisations.
- What happens to our data when we leave? The agreement must ensure the data is deleted or returned, at your choice (Article 28(3)(g)).
Start with a supplier list
Sikkert.no says organisations should keep an overview of all the suppliers they use, grouped by how critical they are and how much they handle. A simple document will do: service, data held, contact person, where the agreement is filed and who follows up. If you use Microsoft 365, it belongs on the list too – see our guide to getting started with Microsoft 365 for nonprofits.
Is there a free data processing agreement template?
Yes. Datatilsynet points to the standard agreement from the Danish data protection authority, reviewed by the European Data Protection Board and available in English. Using it is voluntary.
What does “digital judgement” mean for a board?
Norway’s National Security Month, which ends on 31 October, has the theme “Digital judgement – small choices, big consequences”. A survey by Opinion for NorSIS at NSM (June 2026) of 722 full-time employees at businesses with 11–50 staff found that nearly three in ten are unsure of their ability to handle digital threats.
11 per cent do not know how or where to report an incident. The figures come from small businesses, not nonprofits, but the question fits any board: do your volunteers know whom to tell when something looks wrong?
“Digital judgement is not just an individual responsibility,” says Marius Storsveen Rødsand, senior adviser at NorSIS at NSM. For a board, that means one named person who reports breaches and a culture where it is fine to say “I clicked something odd”. The same board responsibility lies behind our advice on company hijacking and alerts from the Brønnøysund Register Centre.
The supplier questions apply to AI tools as well. At the AI seminar day for nonprofits on 20 November, organised by InfoDesk AS and Skjld Labs with technology contributed by OpenInfo, the 10:35 session is “Safe AI: the EU AI Act, privacy and security”.
Frequently asked questions
How many attacks were reported to Datatilsynet in the first half of 2026?
282 reports of deliberate attacks in January–June 2026, against 103 a year earlier.
What is a supply chain attack?
A breach at one supplier that gives attackers access to the data of many customers using the same service.
Does a small nonprofit need a data processing agreement?
Yes, if a supplier processes personal data on your behalf – for example in a cloud-based membership system.
Who reports the breach if the supplier is hacked?
Your organisation, as the controller – as a rule within 72 hours of becoming aware of the breach.
What should the board do first?
List every supplier that holds member data, find the data processing agreements and send the five questions.
