Norway's Aid Agency Norad Shuts Its Grants Portal After Attackers Use 27 Accounts to Reach 20,614 Users: Why Partner Portals Are a Soft Target

On Friday 30 October 2026, the Norwegian Agency for Development Cooperation, Norad, discovered that attackers were inside its Grants Portal, the system through which organisations around the world apply for Norwegian development funding. The portal was closed immediately, and the incident is now the subject of a police report, a crisis team and an external forensic investigation. What has emerged since is a compact illustration of a problem that reaches far beyond aid: when thousands of outside users can log in to your system, the security of that system depends partly on people and devices you do not control.

Norad's own figures tell the story. The attackers got in by misusing 27 user accounts. From there, the agency says, they may have accessed the names and email addresses of all 20,614 registered users, and they extracted information from grant applications submitted by at least three organisations. Some of the people on that list work in places where being linked to foreign funding is dangerous.

What Happened

Norad published its first statement on Tuesday 3 November and has updated it since, most recently on 6 November. The statement says the attack was discovered on 30 October, that the perpetrators gained access by abusing 27 user accounts to log in, and that the owners of those accounts have been notified. The portal has 20,614 users representing 12,511 organisations worldwide and has been in use since 2017. It is operated by Norad and used by both the agency and the Ministry of Foreign Affairs to receive applications in response to calls for proposals.

The initial public account referred only to the 27 accounts. On 4 November the development news site Panorama Nyheter reported, after interviewing Norad's digitalisation director, that the exposure could be far wider, and Norad's updated statement now says the same: the names and email addresses of every registered user may have been accessed, and application information from at least three organisations, all outside Norway, had been extracted. Norad says other organisations may also be affected and that the full extent is still being determined.

"The attack is complex," said Torger Kjeldstad, director of Norad's Department for Digitalisation, explaining why external cyber security specialists have been brought in to establish what was obtained. "We view this as an extremely serious matter," he said, adding that it is "now critical that we gain a complete understanding of the attack and its potential consequences". He told Panorama, in Norwegian: "We cannot rule out that names of applicants in conflict areas or in authoritarian states have been extracted." Quotations from Norwegian sources in this article are our translations.

Norad has activated its crisis management team, reported the incident to the police and notified both Datatilsynet, the Norwegian Data Protection Authority, and NSM, the National Security Authority. It is contacting all 20,614 users and the three organisations whose applications were taken.

What Is Not Yet Known

Norad has not said how the 27 accounts were compromised. The common routes to account takeover on any public portal are passwords reused from other breached services, phishing and credential-stealing malware on users' own devices, but none of these has been confirmed here. Nor has the agency explained how logging in as 27 users could expose the names and email addresses of every registered user. That question, whether an ordinary account could see more than its own data, is one the forensic investigation will need to answer.

Attribution is also open. Norad says the perpetrators are unidentified. NSM has said only that the attack shares characteristics with other recent cyber attacks. Torgeir Waterhouse, a partner at the Norwegian consultancy Otte, told Panorama he considered Russian involvement very likely given the geopolitical situation, while accepting that other actors could be responsible. That is one expert's view and should be read as such.

Who Is Affected

The portal handles applications, not payments. Norad says applications are not assessed and funds are not disbursed through it, and funding for multilateral bodies such as the United Nations does not pass through it. Panorama reports that it held applications rather than payment information. The direct exposure is therefore of identities, contact details and, for at least three organisations, the content of their applications.

In most breaches a name and an email address would be the least sensitive category. Here the context changes that. Norad manages most of Norway's development aid, around 32 billion kroner in 2025 according to Cybernews, and its partners include local organisations in Africa, Asia, Latin America and the Middle East. Applications under Norway's Nansen support programme for Ukraine also go through the portal, and it is not yet known whether Ukrainian organisations are among those affected. As Waterhouse put it to Panorama, simply being registered as an applicant could be a security risk depending on the country and the regime, and there is "a direct connection between data and people's lives and health".

For UK and European readers there is a direct connection too. With 12,511 organisations registered worldwide, charities, universities, consultancies and NGOs that have applied for Norwegian funding at any point since 2017 should assume that the names and email addresses of the staff who registered are among those that may have been accessed, and should expect Norad's notification.

Why It Matters

Cybergen follows Norwegian and Nordic developments closely, and the timing here is notable. NSM raised Norway's national cyber risk level to High on 28 October. On 30 October, the day Norad discovered its intrusion, UiT The Arctic University of Norway announced that it was handling a targeted attack. No link between the two has been established, and Waterhouse told Panorama it was impossible to know whether they were connected. Both are evidence of the heightened activity the authorities warned about.

The wider lesson is about portals. Grant-makers, councils, housing providers, universities, regulators and businesses of every size run systems where applicants, suppliers, customers or tenants create their own accounts. Those accounts are protected by whatever password the user chose, on whatever device they use, and the organisation running the portal usually has no visibility of either. If a handful of those accounts is taken over, the damage is limited only by what an ordinary logged-in user is able to see and do. In well-designed systems that is very little. In many older portals it is more than anyone intended, because directory, search and export features were built for convenience at a time when nobody expected a hostile user on the inside.

It is also a lesson about the value of lists. A register of thousands of civil society organisations, with named contacts and the countries they work in, is valuable to a hostile state as an intelligence product and to criminals as a phishing list. Sensitivity is a property of context, not of data type, and risk assessments that rate "name and email" as low by default miss cases like this one.

What To Do Now

Require multi-factor authentication for external users. If outside users can log in to a system holding other people's data, a password alone is no longer adequate. Offer authenticator apps or passkeys and make them mandatory for accounts linked to sensitive applications.

Detect account takeover at the door. Rate-limit logins, block passwords known to have appeared in breaches, and alert on patterns such as many accounts being accessed from one address or one account from an unusual country.

Test what an ordinary user can see. Commission a penetration test that starts from a standard low-privilege account and tries to read other users' records, enumerate the user directory and export data in bulk. Broken access control consistently ranks among the most common serious weaknesses in web applications.

Reduce what the portal holds. A system in use since 2017 accumulates dormant accounts and old applications. Close accounts that have not been used, archive completed applications away from the internet-facing system and keep only what is needed.

Log and alert on volume. Twenty-seven accounts reading thousands of records should stand out. Make sure access to user lists and application documents is logged and that unusual volumes trigger an alert.

If your organisation is registered on Norad's portal, follow the guidance Norad sends you, change the password used there and anywhere else it was reused, and brief colleagues to be wary of emails that appear to come from Norad or the Norwegian Ministry of Foreign Affairs, particularly any that ask for logins or changes to bank details. If your application named staff or partners working in high-risk locations, review their safety with them now rather than waiting for the investigation to conclude.

How Cybergen Can Help

Cybergen's CREST penetration testing team tests web portals from the position of an ordinary logged-in user, which is where incidents like this one begin. Our cyber threat intelligence service tracks activity affecting organisations in the UK, Norway and the wider Nordic region, and our incident response service supports organisations that need to investigate and notify at scale.

Frequently Asked Questions