Norad, Norway’s Agency for Development Cooperation, has confirmed a cyberattack on its grants portal that may have exposed the names and email addresses of all 20,614 registered users. Attackers also obtained application files from at least 3 organizations outside Norway, the agency said, and it cannot rule out that more organizations were affected.
The intrusion was discovered on Friday, October 30, 2026. According to Norad, the attackers got into the portal by abusing 27 compromised user accounts. The agency closed the portal immediately, stood up a crisis team and is bringing in external cybersecurity experts to map what information was reached.
What was exposed
Norad says the attackers may have obtained names and email addresses for every registered account on the grants portal. Those 20,614 users represent 12,511 organizations worldwide. The portal has been in use since 2017 and is the digital platform that Norad and Norway’s Ministry of Foreign Affairs use to collect funding applications for aid and development projects.
Application materials and attachments belonging to 3 organizations based outside Norway were taken. Norad warned that additional organizations may turn out to be affected as the investigation continues. The agency also said it cannot exclude that names of applicants operating in conflict zones and authoritarian states were among the data reached, a risk it described as extremely serious.
Torger Kjeldstad, Norad’s director of digitalisation, said the attack is complex. “The portal was closed down immediately and we are still working to determine the full extent of the attack. At this stage, we do not know who is behind it,” he said in the agency’s public notice.
Response and notifications
Norad has reported the incident to Norwegian police, the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM). NSM said the attack shares characteristics with other recent cyberattacks, though Norad’s statement does not identify which campaigns those comparisons refer to.
The agency said it notified the owners of the 27 accounts used in the intrusion and is working to inform all 20,614 registered users plus the 3 organizations known to have had application files taken. Norad stressed that assessment of applications and payment of grants do not happen inside the grants portal itself, and that support routed to multilateral organizations such as the United Nations does not go through the portal.
- 20,614 registered users across 12,511 organizations may have had names and emails exposed.
- 27 compromised accounts were used for access.
- Application files for at least 3 non-Norwegian organizations were taken.
- Portal shut down; police, Datatilsynet and NSM notified.
Why it matters
Aid and development portals often hold contact details and project documents for civil society groups, local partners and individuals working in high-risk regions. Exposure of those identities can create safety and privacy risks beyond ordinary credential reuse. Norad said it is focused on understanding the full consequences of the attack and on keeping its digital services safe to use.
No threat group had been publicly named for the Norad incident at time of publication. The agency had not issued any public statement identifying a specific actor or confirming whether data has appeared for sale or leak beyond the access already described.
Credential abuse against customer and partner portals has been a theme in other recent disclosures covered by BreachNews, including the Chainalysis and WorkOS incidents. BreachNews will update this report when Norad publishes further findings on scope, affected organizations or attribution.
