Short answer
Norad said on 3 November 2026 that attackers logged in to its Grants Portal by abusing 27 user accounts after the attack was discovered on 30 October. Names and email addresses of 20,614 registered users may have been accessed, and application data from three foreign organizations was confirmed compromised.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Norad (Norwegian Agency for Development Cooperation) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Government and development aid |
| Country | Norway |
| Detected | 2026-10-30 |
| Disclosed | 2026-11-03 |
| People or records affected | 20,614 registered portal users across 12,511 organizations may have had names and email addresses accessed |
What data was exposed
- Names and email addresses of 20,614 registered users of the Grants Portal
- Application information from at least three organizations outside Norway, confirmed compromised
- Norad cannot rule out that names of applicants in conflict zones and authoritarian states were accessed
What happened
Norad, Norway’s agency for development cooperation, published a notice on 3 November 2026 saying its Grants Portal had been hit by a cyberattack. The portal is used by Norad and the Norwegian Ministry of Foreign Affairs for development funding applications and has been in use since 2017. Norad says the attack was discovered on 30 October and that the attackers got in by abusing 27 user accounts.
The Register covered the incident on 5 November. It reported that Norad’s director of digitalization, Torger Kjeldstad, called the attack “complex” and said it “should be safe” to keep using Norad’s services.
What may have been taken
Norad says names and email addresses of 20,614 registered users may have been accessed. Those users represent 12,511 organizations worldwide. Application information from three organizations outside Norway has been confirmed as compromised, and Norad says more may follow as the investigation continues. External cybersecurity experts are assessing what the attackers obtained.
The most sensitive point is in Norad’s own wording: it cannot rule out that names of applicants in conflict zones and authoritarian states were accessed. It is not clear from either source whether such applicants were among the registered users.
Norad also says funding for multilateral organizations such as the UN is not processed through the portal, and that applications are not assessed and funding is not disbursed there.
Response so far
Norad closed the portal, notified the owners of the affected accounts and reported the incident to Datatilsynet, the National Security Authority (NSM) and the police. The perpetrators are not identified. NSM says the attack shares characteristics with other recent cyberattacks, but Norad has not said which. No attacker has claimed responsibility in the sources we reviewed.
Norad did not say how long the attackers had access before 30 October, how many records were downloaded, or how the 27 accounts were obtained. We will not guess at those answers.
Why the scam risk is real
A list of grant applicants is a ready-made target list. Charities and NGOs routinely get genuine emails about funding rounds, deadlines and portal logins, so a fake one is easy to slip in. The likeliest abuse is phishing that copies Norad’s tone, asks the recipient to sign in to a copy of the portal, or promises a grant in return for a fee. The same names and addresses could also be used in targeted approaches against people working in sensitive regions.
If you hold a Grants Portal account, do not click links in unexpected portal emails. Go to the portal address you already use, and follow Norad’s guidance for affected users.
For general steps after any breach, see our data breach checklist. Messages that pose as an agency or a funder fit the pattern in our guide to government impersonation scams and to phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Spear-phishing emails posing as Norad, the Norwegian Ministry of Foreign Affairs or a grant officer, sent to the exposed addresses.
- Fake 'update your portal password' or 'confirm your application' messages that lead to credential-harvesting pages.
- Fake grant award or funding offers that ask for a fee or bank details, aimed at charities and NGOs.
What to do if you are affected
- 01Read Norad's 'Information for affected users' page on its partner site and follow what it says.
- 02Change your Grants Portal password, and change it anywhere else you reused it. Turn on multi-factor authentication where offered.
- 03Treat any email that mentions Norad or a grant application as suspicious until you confirm it by typing the address yourself or phoning a number you already hold.
- 04If you applied from a conflict zone or a restrictive state, tell your organization's security lead and Norad now, so they can assess personal risk.
- 05Report suspicious messages to Norad's contacts and, in Norway, to the police.
Frequently asked questions
What did the attackers get from Norad?
Norad says names and email addresses of all 20,614 registered users of its Grants Portal may have been accessed, and application information from three organizations outside Norway was confirmed compromised. It says other organizations may also be affected as external experts assess what was taken.
How did the attackers get in?
Norad says they logged in by abusing 27 user accounts. It has not said how those accounts were obtained, and the perpetrators are unidentified. The Norwegian National Security Authority (NSM) says the attack shares characteristics with other recent cyberattacks.
Are aid payments affected?
Norad says funding for multilateral organizations such as the UN is not processed through the portal, and that applications are not assessed and funding is not disbursed through it. The portal has been closed while the incident is handled.
Who has been told?
Norad says it notified the owners of the affected accounts and reported the incident to Datatilsynet (the Norwegian data protection authority), NSM and the police.
Sources
- Norad targeted by cyberattack, Norad, 2026-11-03
- Norway's aid agency pwned and all users' data is stolen, The Register, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.