---
title: Norad: Grants Portal attack may have exposed names and emails of 20,614 users; applications from at least three organizations taken | ctxsec
url: https://ctxsec.com/items/norad-grants-portal-cyberattack-20614-users-nov-3
description: "Norway's development agency Norad says attackers abused 27 user accounts to reach its Grants Portal (discovered Oct 30). They may have obtained names and email addresses for 20,614 registered users across 12,511 organizations, plus application material from at least three organizations outside Norway \u2014 more may be affected. The portal was shut down. Norad notified Datatilsynet and NSM, reported to police, told the 27 account owners, and is notifying the broader user base. Identity of the attackers is unknown; Norad cannot rule out that applicant names in conflict zones or authoritarian states were accessed."
status: "official (Norad, published Nov 3, updated Nov 6); attribution unknown; NSM says characteristics match other recent attacks"
published: 2026-11-06
---

> Norway's development agency Norad says attackers abused 27 user accounts to reach its Grants Portal (discovered Oct 30). They may have obtained names and email addresses for 20,614 registered users across 12,511 organizations, plus application material from at least three organizations outside Norway — more may be affected. The portal was shut down. Norad notified Datatilsynet and NSM, reported to police, told the 27 account owners, and is notifying the broader user base. Identity of the attackers is unknown; Norad cannot rule out that applicant names in conflict zones or authoritarian states were accessed.

[← Cybersecurity News](/news) · [markdown](/items/norad-grants-portal-cyberattack-20614-users-nov-3.md)

official (Norad, published Nov 3, updated Nov 6); attribution unknown; NSM says characteristics match other recent attacks

2026-11-06

### Norad: Grants Portal attack may have exposed names and emails of 20,614 users; applications from at least three organizations taken

- The Grants Portal (in use since 2017) is how MFA and Norad take applications for development funding; multilateral/UN funding is not processed there.
- Norad says it has a good understanding of the incident but has brought in external experts to confirm what was taken.
- If you use the portal: watch for phishing that quotes real grant or contact details, and wait for Norad's official notice rather than unsolicited 're-verify' messages.

Sources: [Norad: Norad targeted by cyberattack (updated Nov 6)](https://www.norad.no/en/news/news/2026/norad-targeted-by-cyberattack/)