Norad says names and emails of 20,614 grant-portal users may have been exposed

If you have ever applied for Norwegian development funding through Norad’s Grants Portal, your name and email address may now be in someone else’s hands. Norad, the Norwegian Agency for Development Cooperation, said a cyberattack discovered on October 30, 2026 reached the portal used by the agency and the Ministry of Foreign Affairs. The portal is shut. The people behind the attack are not known.

What happened

Norad’s news release, first published on November 3 and updated on November 6, and its page for affected users, published on November 5 and also updated on November 6, give this account:

• The Grants Portal has been in use since 2017. It has 20,614 registered users, from 12,511 organisations around the world.
• The attack was discovered on October 30. Attackers got in by misusing 27 user accounts to log in that day. Norad has told the owners of those accounts directly.
• The first names, last names and email addresses of all 20,614 registered users may have been exposed. Norad is working to tell them.
• Information from grant applications submitted by three organisations outside Norway was taken, including supporting documents. Those three organisations have been notified. Norad says more organisations could turn out to be affected.
• The portal was closed as soon as the attack was discovered. It is still down, so users cannot change their portal password there.
• Norad has notified the Norwegian Data Protection Authority (Datatilsynet) and the Norwegian National Security Authority (NSM), and has reported the incident to the police.

Funding for multilateral organisations such as the UN does not go through this portal. Applications are not assessed there, and money is not paid out there. It is the system applicants use to file proposals in response to calls.

What Norad and NSM have said

Torger Kjeldstad, Norad’s director of digitalisation, said the attack is complex and that the agency has a good picture of the incident so far, but has brought in outside cybersecurity specialists to judge what the attackers actually reached. “This is a serious incident,” he said. “The portal was closed down immediately, and we are still working to determine the full extent of the attack. At this stage, we do not know who is behind it.”

NSM has told Norad that the attack shares characteristics with other recent cyberattacks. Norad’s statements do not name those other attacks. The agency also says it cannot rule out that the names of applicants working in conflict zones and authoritarian states were among the data reached. It calls that possibility an extremely serious matter, and it points people who fear for their safety to their own organisation’s security lead, or to Norad, without putting sensitive details in an ordinary email.

Having your name and email on the list of 20,614 does not mean your account was one of the 27 that were misused, and it does not mean your organisation’s application was one of the three that were taken.

What this means for you

A name and an email address are enough to send a message that looks like it comes from Norad, the Ministry of Foreign Affairs, or a partner you already work with. That is the risk Norad is warning about: a request to sign in, send a password, share documents or make a payment, written so that it sounds familiar. The application files are a smaller set, three organisations so far, but those files can be much more sensitive than a contact list, especially for groups working in places where being named is dangerous.

What you can do

1. Treat unexpected mail about a Norwegian grant as suspect, even if it uses your name. Norad says not to click links or open attachments in that message, and not to use any phone number or address printed in it.
2. Check through a channel you already trust. Norad’s dedicated address for this incident is cyberincident@norad.no. Do not send passwords, sensitive personal information or confidential application documents to that address. If you need to share something sensitive, ask Norad how to do it first.
3. If you reused the Grants Portal password anywhere else, change it on those other accounts and turn on multi-factor authentication where you can. Norad says this is a general precaution. It also says that unless you have received an email from Norad stating that your information was leaked, you are not among the organisations known to have had application files taken. You cannot change the portal password itself while the portal is shut.
4. If being named could put you or someone else at risk, talk to your organisation’s security lead or a trusted adviser, and contact Norad without putting those details in the first email.
5. Expect copycat messages. After a notice like this, people who had nothing to do with the break-in still write to victims. See how scammers use leaked data to make a message feel personal.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• How scammers use leaked data to make phishing personal: what a name and an email address are worth to someone writing a fake grant message.

Sources

• Norad, Norad targeted by cyberattack, published November 3, 2026, updated November 6, 2026
• Norad, Cyberattack on Norad: Information for affected users, published November 5, 2026, updated November 6, 2026