# Norway's aid agency Norad says attackers took names and emails of all 20,614 Grants Portal users · pwn.watch > Norad, Norway's development aid agency, says attackers abused 27 user accounts to log in to its Grants Portal, the platform the Ministry of Foreign Affairs and Norad use for aid and development funding applications from around the world. The attack was discovered on Oct 30 2026 and the portal was shut down immediately. The attackers may have gained access to the names and email addresses of all 20,614 registered users from 12,511 organizations, and applications and supporting documents from at least three organizations outside Norway were taken, possibly more. Norad cannot rule out that names of applicants working in conflict zones and authoritarian states were accessed. It does not know who is behind the attack; Norway's National Security Authority (NSM) says it shares characteristics with other recent attacks. Norad has notified the data protection authority and NSM, reported the incident to the police, set up a crisis team and is bringing in outside experts. Page: https://pwn.watch/i/norad-grants-portal-breach-nov-2026 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: medium · status: live · patch: partial - Product: Norad Grants Portal (Tilskuddsportalen) - Started: 2026-10-30 - Affected: All 20,614 registered Norad Grants Portal users (12,511 organizations); applications from at least three organizations outside Norway - Fixed in: Portal shut down on Oct 30 2026; investigation ongoing, nothing for users to patch ## Follow this incident - RSS (one item per update): https://pwn.watch/i/norad-grants-portal-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/norad-grants-portal-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/norad-grants-portal-breach-nov-2026.json - This file: https://pwn.watch/i/norad-grants-portal-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: The Register reports Norad is bringing in outside cybersecurity experts and has not said how long the attackers had access. (https://www.theregister.com/cyber-crime/2026/11/05/norways-aid-agency-pwned-and-all-users-data-is-stolen/5307765) - 2026-11-04: Norad sets up a crisis team and tells Panorama it cannot rule out that names of applicants in conflict zones or authoritarian states were taken. (https://www.panoramanyheter.no/krig-og-konflikt-menneskerettigheter-norad/norad-har-satt-krisestab-sensitiv-informasjon-om-partnere-i-konfliktomrader-kan-vaere-stjalet/434933) - 2026-11-03: Norad discloses the attack: names and email addresses of all 20,614 registered users may have been accessed and applications from at least three organizations outside Norway were taken. It has notified the 27 account owners, Datatilsynet and NSM, and reported it to the police; NSM says it resembles other recent attacks. (https://www.norad.no/en/news/news/2026/norad-targeted-by-cyberattack/) - 2026-10-30: Norad discovers the attack on its Grants Portal, where attackers logged in by abusing 27 user accounts, and shuts the portal down immediately. (https://www.norad.no/en/news/news/2026/norad-targeted-by-cyberattack/) ## Fix brief # Security brief: Norway's aid agency Norad says attackers took names and emails of all 20,614 Grants Portal users Source: https://pwn.watch/i/norad-grants-portal-breach-nov-2026 · status: live · severity: medium · updated Nov 5, 2026, 14:17 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Norad, Norway's development aid agency, says attackers abused 27 user accounts to log in to its Grants Portal, the platform the Ministry of Foreign Affairs and Norad use for aid and development funding applications from around the world. The attack was discovered on Oct 30 2026 and the portal was shut down immediately. The attackers may have gained access to the names and email addresses of all 20,614 registered users from 12,511 organizations, and applications and supporting documents from at least three organizations outside Norway were taken, possibly more. Norad cannot rule out that names of applicants working in conflict zones and authoritarian states were accessed. It does not know who is behind the attack; Norway's National Security Authority (NSM) says it shares characteristics with other recent attacks. Norad has notified the data protection authority and NSM, reported the incident to the police, set up a crisis team and is bringing in outside experts. Severity detail: Names and emails of all 20,614 portal users plus some grant applications taken; possible exposure of applicants in conflict zones and authoritarian states - Product: Norad Grants Portal (Tilskuddsportalen) ## Affected versions - All 20,614 registered Norad Grants Portal users (12,511 organizations); applications from at least three organizations outside Norway ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Portal shut down on Oct 30 2026; investigation ongoing, nothing for users to patch After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Norad Grants Portal users have nothing to patch. Expect a notification from Norad, and treat unexpected emails about Norad grants or applications as possible phishing. ## Latest updates - Nov 5, 2026: The Register reports Norad is bringing in outside cybersecurity experts and has not said how long the attackers had access. - Nov 4, 2026: Norad sets up a crisis team and tells Panorama it cannot rule out that names of applicants in conflict zones or authoritarian states were taken. - Nov 3, 2026: Norad discloses the attack: names and email addresses of all 20,614 registered users may have been accessed and applications from at least three organizations outside Norway were taken. It has notified the 27 account owners, Datatilsynet and NSM, and reported it to the police; NSM says it resembles other recent attacks. - Oct 30, 2026: Norad discovers the attack on its Grants Portal, where attackers logged in by abusing 27 user accounts, and shuts the portal down immediately. ## Advisories - [Norad targeted by cyberattack](https://www.norad.no/en/news/news/2026/norad-targeted-by-cyberattack/) (Norad) - [Norad utsatt for dataangrep](https://www.norad.no/aktuelt/nyheter/2026/norad-utsatt-for-dataangrep/) (Norad) ## Write-ups & news - [Cyberattack on Norway’s aid agency may have swept up all user data](https://www.helpnetsecurity.com/2026/11/05/norad-grants-portal-breach/) - [Norad har satt krisestab: Sensitiv informasjon om partnere i konfliktområder kan være stjålet](https://www.panoramanyheter.no/krig-og-konflikt-menneskerettigheter-norad/norad-har-satt-krisestab-sensitiv-informasjon-om-partnere-i-konfliktomrader-kan-vaere-stjalet/434933) - [Norway's aid agency pwned and all users' data is stolen](https://www.theregister.com/cyber-crime/2026/11/05/norways-aid-agency-pwned-and-all-users-data-is-stolen/5307765) --- Machine-readable: https://pwn.watch/i/norad-grants-portal-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.