Norway's aid agency Norad says attackers took names and emails of all 20,614 Grants Portal users
Norad Grants Portal (Tilskuddsportalen)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Norad, Norway's development aid agency, says attackers abused 27 user accounts to log in to its Grants Portal, the platform the Ministry of Foreign Affairs and Norad use for aid and development funding applications from around the world. The attack was discovered on Oct 30 2026 and the portal was shut down immediately. The attackers may have gained access to the names and email addresses of all 20,614 registered users from 12,511 organizations, and applications and supporting documents from at least three organizations outside Norway were taken, possibly more. Norad cannot rule out that names of applicants working in conflict zones and authoritarian states were accessed. It does not know who is behind the attack; Norway's National Security Authority (NSM) says it shares characteristics with other recent attacks. Norad has notified the data protection authority and NSM, reported the incident to the police, set up a crisis team and is bringing in outside experts.
Why this severity: Names and emails of all 20,614 portal users plus some grant applications taken; possible exposure of applicants in conflict zones and authoritarian states
- Started
- Oct 30, 2026
Affected
- All 20,614 registered Norad Grants Portal users (12,511 organizations); applications from at least three organizations outside Norway
Fixed in
- Portal shut down on Oct 30 2026; investigation ongoing, nothing for users to patch
Timeline4
The Register reports Norad is bringing in outside cybersecurity experts and has not said how long the attackers had access.
Norad sets up a crisis team and tells Panorama it cannot rule out that names of applicants in conflict zones or authoritarian states were taken.
Norad discloses the attack: names and email addresses of all 20,614 registered users may have been accessed and applications from at least three organizations outside Norway were taken. It has notified the 27 account owners, Datatilsynet and NSM, and reported it to the police; NSM says it resembles other recent attacks.
Norad discovers the attack on its Grants Portal, where attackers logged in by abusing 27 user accounts, and shuts the portal down immediately.
Advisories2
News & write-ups3
- Cyberattack on Norway’s aid agency may have swept up all user dataHelp Net Security · Nov 5, 2026
- Norad har satt krisestab: Sensitiv informasjon om partnere i konfliktområder kan være stjåletPanorama nyheter · Nov 4, 2026
- Norway's aid agency pwned and all users' data is stolenThe Register · Nov 5, 2026
Get an email when a new major security incident drops. No spam, unsubscribe any time.
