Norad says cyber attack may have exposed all Grants Portal user data

Norad disclosed on Nov. 5, 2026, that intruders may have accessed the names and e-mail addresses of all 20,614 registered users of its Grants Portal.

The Grants Portal is run by the Norwegian Agency for Development Cooperation, which partners with organizations worldwide on development aid work. Norway’s Ministry of Foreign Affairs also uses the portal to collect funding applications for international aid projects. Norad said the portal began operating in 2017, and its users represent 12,511 organizations across the globe. Norad said every one of those users may be affected, and the agency described the incident as extremely serious.

Norad said it found the intrusion on Oct. 30 and closed the Grants Portal immediately as part of its initial response. The intruders logged in using 27 compromised user accounts, and Norad contacted the owners of those accounts on Tuesday. Torger Kjeldstad described the attack as complex. The agency activated its crisis management team to coordinate the response.

Three organizations based outside Norway had applications and supporting documents taken from them. Norad warned that more organizations might also be affected. Norad said it cannot rule out attackers obtaining the names of applicants in conflict zones and authoritarian states. The agency stressed the importance of informing those affected.

Outside cybersecurity experts will assess what data the intruders reached. It also reported the incident to the police, the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM). NSM said the incident resembles other recent attacks, though Norad did not identify those attacks. Norad does not know the identity of the attackers.

Torger Kjeldstad leads Norad’s Department for Digitalisation. He said the portal was closed down immediately. Kjeldstad stressed that informing those affected matters. Norad plans to update its statement while the investigation continues.

Notification is going out to all registered users and the three organizations identified as affected. Torger Kjeldstad said, “The portal was closed down immediately, and we are still working to determine the full extent of the attack.”