Norad, Norway’s development aid agency, says a cyberattack on its Grants Portal may have exposed the names and email addresses of 20,614 registered users. The agency disclosed the Norad Grants Portal breach in a notice published on 3 November 2026.
Separately, Norad says attackers also reached grant-application material from three organizations, and misused 27 user accounts to sign in to the portal. Norad found the intrusion on 30 October 2026 and shut the portal down the same day it was discovered.
The Norad Grants Portal Breach, by the Numbers
Norad has published four figures that describe the scope of the incident. Together they show a large pool of exposed contact details sitting alongside a much smaller set of accounts and organizations the agency says were actually misused or compromised.
- 20,614Registered users whose name and email address may be exposed, Norad saysSource: Norad, notices of 3 and 5 November 2026
- 12,511Organizations those users belong to, across the worldSource: Norad, notices of 3 and 5 November 2026
- 27User accounts the attackers misused to sign in to the portalSource: Norad, notices of 3 and 5 November 2026
- 3Organizations whose grant-application files were compromisedSource: Norad, notices of 3 and 5 November 2026
The 20,614 figure is Norad’s own estimate of exposed accounts, spanning 12,511 organizations worldwide. Norad says having a name and email address exposed does not mean an account was misused or that an organization’s application data was leaked.
A smaller number sits inside the larger one. Three organizations had grant-application files compromised, and Norad says it has contacted them directly. The agency also notified the owners of the 27 user accounts that were misused to log in.
What Happened, and When?
Norad says the Grants Portal intrusion began on 30 October 2026, when attackers logged in using the 27 misused accounts. Norad has notified the Norwegian National Security Authority (NSM), along with the Datatilsynet and the police, but neither source says who it believes is behind the attack. The identity of the attackers is still unknown as of Norad’s most recent update.
“This is a serious incident,” says Torger Kjeldstad, Norad’s Director of Digitalization, in the notice. “The portal was closed down immediately, and we are still working to determine the full extent of the attack.”
Norad’s notices do not say how the 27 accounts were obtained, whether through phishing, reused passwords or another method. The agency says only that the accounts were misused to sign in on 30 October 2026.
Norad shut the portal down immediately after finding the intrusion. The agency, outside cybersecurity specialists, the Norwegian Data Protection Authority (Datatilsynet) and the police are all working through the incident, Norad says.
Kjeldstad also calls the incident “extremely serious” and says understanding the attack’s full scope is now critical for Norad. The agency has not given a date for when it expects that assessment to be finished.
Who Might Be at Risk?
Norad says it cannot rule out that the names of applicants working in conflict zones or authoritarian states are among the exposed data. The Grants Portal has run since 2017 and serves funding applicants from around the world, so the exposure reaches well beyond Norway.
Norad is the Norwegian Agency for Development Cooperation, and it operates the Grants Portal for the Norwegian Ministry of Foreign Affairs. The portal handles funding applications and the documents applicants upload; it does not process payments or decide awards, Norad says.
Funding for multilateral bodies such as the United Nations does not go through the Grants Portal, Norad says. The portal only receives and stores applications and documents submitted against a specific call for proposals.
What Should Affected Users Do?
Norad’s advice centers on treating unexpected messages with care. The agency says to be alert to messages that claim to come from Norad, the Norwegian Ministry of Foreign Affairs, or a Norwegian grant. Norad also says to be wary of any request to sign in, share a password or make a payment.
Norad says to check a request through a channel you already trust, not the contact details inside the suspicious message itself. For anyone who reused a Grants Portal password elsewhere, Norad recommends changing it on those other accounts and turning on multi-factor authentication where it is available.
Users with questions or safety concerns can reach Norad at cyberincident@norad.no, the agency says. It asks that people avoid sending passwords or sensitive application details by email.
The portal itself stays shut while Norad investigates, so the agency says users cannot change a Grants Portal password right now. Norad says it will share more information about using the portal again at a later date.
What Does Norad Say It Is Doing?
Norad has reported the breach to the police and notified the Datatilsynet and the NSM, the agency says. It has activated a crisis-management team and brought in outside cybersecurity specialists to assess what the attackers reached.
The three affected organizations and the owners of the 27 misused accounts have been notified directly, Norad says. Both the press notice and the page for affected users say they will be updated as the investigation continues.
These numbers come from two of Norad’s own pages. One is its 3 November 2026 press notice; the other is a companion page for affected users published 5 November 2026, and both have been updated since first posted. Norad has not yet published a count of how many of the 20,614 exposed accounts, if any, had information beyond a name and email address taken.
An attack built on misused, valid logins rather than a software flaw is harder to stop with a single fix. That is likely why Norad’s advice to affected users centers on verifying messages and resetting reused passwords elsewhere, rather than on patching the portal itself.
This pattern of account takeover through misused logins, rather than a straight data breach of a flawed system, shows up at public bodies elsewhere too. A similarly self-disclosed government incident is covered in our report on the DHS employee data leak.