Norad Grants Portal breach — attackers used 27 compromised accounts, all 20,614 users' data at risk
Severity: high · Patch status: no-fix-needed · Since 2026-11-05 · CVE-2026-107441
Norway's development aid agency Norad disclosed a cyberattack on its Grants Portal, used since 2017 by Norad and the Ministry of Foreign Affairs to collect aid funding applications. Intruders logged in with 27 compromised user accounts and stole applications and supporting documents from three organizations outside Norway. Norad warns the names and email addresses of all 20,614 registered users representing 12,511 organizations may have been taken, and cannot rule out exposure of applicants operating in conflict zones and authoritarian states. The portal was shut down immediately; a crisis team and external cybersecurity experts are assessing the full scope. The incident was reported to police, Datatilsynet and NSM, which says it shares characteristics with other recent attacks. Attribution is unknown; user notifications are underway.
What to do
- If you had an account on the Norad Grants Portal, assume your name and email were exposed and watch for targeted phishing using grant-application lures
- Change any reused credentials tied to that portal account and enable MFA elsewhere
- Organizations that submitted applications via the portal should review what documents they submitted and assess sensitivity of exposed content
- NGOs operating in conflict zones or authoritarian states should review physical and digital safety of exposed applicant identities
- Be alert to follow-on social engineering referencing your grant applications or Norad correspondence
Sources
All live incidents on Threat Watch
