Norad says 27 abused logins opened its Grants Portal and may have exposed 20,614 users' names and emails

27 accounts out of 20,614, and no word on how they were taken

Norad, Norway's agency for development cooperation, says the attackers who got into its Grants Portal did not break it open. In its notice of 3 November 2026 it says they "gained access to the portal by abusing 27 user accounts to log in". Set against the 20,614 registered users Norad counts, those 27 accounts are 0.13 percent of the user base (derived: 27 divided by 20,614). That small share was enough, Norad says, to put the names and email addresses of all 20,614 users, from 12,511 organisations around the world, within possible reach, and to extract information on applications from at least three organisations outside Norway.

Two more computed facts frame the rest. The portal holds on average about 1.65 users per organisation (derived: 20,614 divided by 12,511), so the exposed list is close to a directory of the organisations that apply to Norway for aid, with a contact person or two at each. And the notice came 4 days after discovery (derived: 30 October to 3 November), with a separate page for affected users on 5 November, 6 days after discovery. This briefing rests on Norad's English notice, that page and the Norwegian notice, all read in full at about 16:35 UTC on Saturday 7 November 2026.

What those figures do not establish. Norad does not say how the 27 accounts were compromised: not phishing, not reused passwords, not a missing second login step. It does not say whether the portal offered or enforced multi factor authentication. It does not say who did it, and it says it does not know. It relays that Norway's National Security Authority, NSM, sees characteristics shared "with other recent cyberattacks", but not which attacks. And it does not say whether the three organisations' applications named people who are now at risk. Each of these is set out below as not stated, because none of them is.

What happened, in the order Norad gives it

Norad's account is short. The attack was discovered on 30 October, which the Norwegian notice says was a Friday. The portal "was closed down immediately". Norad mobilised its crisis management team and says it is engaging external cybersecurity experts to assess what the attackers reached. It notified Datatilsynet, the Norwegian Data Protection Authority, and NSM, and reported the incident to the police. Its director of digitalisation is quoted saying the owners of the 27 accounts were told "yesterday", and that Norad was working to inform the 20,614 users and the three organisations it knows are affected.

Zoom

Two points in that order need care. First, "yesterday" sits in a quotation on a page first published on 3 November and updated on 6 November, and Norad prints no date for it. If the quotation dates from first publication, the 27 owners were told on 2 November, three days after discovery; that is this site's inference, not Norad's statement. Second, Norad uses 30 October for two different things. The notices say the attack was discovered that day. The summary box on both English pages says the portal "was targeted by a cyberattack on 30 October", and the page for affected users says the attackers misused the 27 accounts "to access the portal on 30th October". None of the pages says whether any access happened before the day it was found.

Three pages, and where their wording differs

What changed when Norad updated its notices on 6 November? The pages themselves do not say. Their metadata shows the English notice published at 14:49:20 on 3 November and modified at 13:00:41 on 6 November, and the Norwegian notice published at 14:30:58 and modified at 12:59:22, about two minutes apart on the same day; no time zone is printed. A request for an archived copy of the earlier version was refused by the archive with a rate limit, so no earlier text was compared. One thing can be inferred: both notices end with a link to the page for affected users, which was first published on 5 November, so that link was most likely added after first publication. That is inference, not a record of the change.

Comparing the three pages as they stood when read shows where the wording moves. Norwegian passages are translated by this site.

The difference that matters most is the conflict zone sentence. In English, Norad "cannot rule out the possibility that the names of applicants operating in conflict zones and authoritarian states may have been accessed". The Norwegian notice uses "hentet ut", the same verb it uses for the applications that were taken, which reads as cannot rule out that the names were extracted. Both are hedged as possibilities, but the Norwegian is the stronger of the two, and by the page metadata the Norwegian notice went up 18 minutes before the English one. A reader deciding whether to warn colleagues in the field should weigh the stronger wording.

No money moves through it, and that is not the point

Norad describes the Grants Portal as the digital platform "used by the Ministry of Foreign Affairs and Norad" for applications for development funding, open to applicants and partners worldwide, used for applications sent in response to calls for proposals, and in use since 2017. It is careful to say what does not happen there: funding for multilateral organisations such as the UN is not processed through it, applications are not assessed in it, and funding is not disbursed through it.

Zoom

Those reassurances answer a question few readers were asking. Nobody can redirect a payment through a system that makes none, but that was never the asset. The page for affected users says the portal holds "applications for funding submitted to Norad and information uploaded by applicants themselves". For a civil society group working under an authoritarian government, the dangerous record is not a bank transfer. It is the fact that it applied to a foreign ministry at all, the name of the person who applied, and whatever the application said about partners, places and activities. "Not used to make payments" is a true description of the system and a poor description of the risk.

The same goes for the phrase "registered users". On Norad's account, each of the 27 logins looked to the portal like a registered user signing in. A successful login proves that someone held a working credential, not that the account's owner was the one using it. Norad's phrase for this is "compromising and abusing" the accounts, and it says nothing more about how.

What Norad states, and what it does not

NSM's own news pages, read for this briefing, do not mention Norad, so the phrase about other recent attacks rests on Norad's report of what NSM said. The robots file of Datatilsynet's website returned a server error when requested, so its site was not read; the briefing relies on Norad for the fact that Datatilsynet was notified. Datatilsynet is the same authority whose fine on Xandr this site covered in October.

What to do, in order

Items marked as from Norad are its own advice from the page for affected users, ranked first. Everything labelled as this site's suggestion is ours, not Norad's.

Technical details

Norad prints no technical artifacts: no addresses, no indicators, no log lines, no account names, no description of the method and no statement on multi factor authentication. What it does publish is below, copied exactly: its summary of the attack, its advice on passwords, the contact route for affected users, and the publication times in the pages' own metadata.

First, the summary box that appears on both the English notice and the page for affected users. It is the most compact statement of what Norad says happened, and the place the phrase "compromising and abusing" appears.

Norad’s Grants Portal was targeted by a cyberattack on 30 October. The identity of the perpetrators remains unknown.
The attackers gained access to the Grants Portal by compromising and abusing 27 user accounts.
The attackers may have gained access to the names and email addresses associated with 20,614 user accounts belonging to 12,511 organizations around the world.
Applications and supporting documents submitted by three organizations have been compromised. It cannot be ruled out that additional organizations also could be affected.

Second, the password advice. It is framed as a general precaution, it confirms the portal password cannot currently be changed, and it tells users how to tell whether they are among the known affected organisations.

If you have used the same email and password combination for the Grants Portal on other accounts, we recommend you change it on those accounts as a precaution by using a different password for each account and enable multi-factor authentication where available.
This is only a general precautionary recommendation. Unless you have received an email from Norad stating that your information has been leaked, you are not amongst the known affected organizations.
As the portal has been shut down, it is currently not possible to change your password for the portal. We will provide further information regarding the use of the portal at a later date.

Third, the contact route Norad gives for questions, safety concerns and suspicious messages. Use this address, typed by hand, rather than any address in a message that claims to come from Norad.

If you have questions, are concerned about your safety or want to report a suspicious message relating to the attack, please contact Norad at:
cyberincident@norad.no
Do not send passwords, sensitive personal information or confidential application documents by email. If you need to share sensitive information, ask us how to do so securely without including that information in your initial message.

Fourth, the publication and modification times from each page's structured data, as printed with no time zone. They show both notices changed within about two minutes on 6 November, and the users page about 11 to 12 minutes before them; they do not show what changed.

English notice, "Norad targeted by cyberattack"
  datePublished: 2026-11-03T14:49:20
  dateModified:  2026-11-06T13:00:41
Norwegian notice, "Norad utsatt for dataangrep"
  datePublished: 2026-11-03T14:30:58
  dateModified:  2026-11-06T12:59:22
"Cyberattack on Norad: Information for affected users"
  datePublished: 2026-11-05T11:08:29
  dateModified:  2026-11-06T12:48:26

The question Norad has not answered

Norad has been quick and plain about what it knows: 27 accounts, 20,614 names and emails, at least three organisations' applications, the authorities told within days. What it has not said is the thing every other grant platform needs to know. A portal used since 2017 by applicants in conflict zones and authoritarian states let 27 outsiders in through the front door with working logins. Did those accounts need anything more than a password, and if not, why not?

Key facts