Norway’s development aid agency, Norad, is investigating a cyberattack that may have exposed the personal information of more than 20,000 people involved in international development projects. The intrusion also resulted in the theft of grant application materials belonging to at least three organizations.
The attack targeted Norad’s Grants Portal, an online platform used by the agency and Norway’s Ministry of Foreign Affairs to receive applications for development assistance funding. Operating since 2017, the system has 20,614 registered users representing 12,511 organizations worldwide.
Norad discovered the intrusion on October 30, 2026, and immediately shut down the portal. Investigators established that the attackers had gained access by using 27 compromised user accounts, although the agency has not explained how those accounts were initially breached.
According to Norad’s November 3 announcement, the intruders may have accessed the names and email addresses of every registered portal user. The agency has not confirmed whether all 20,614 records were actually obtained.
Investigators have established that application information and supporting documents submitted by three organizations outside Norway were compromised. Norad warned that additional organizations could be affected as specialists continue examining the incident.
The potential exposure is particularly concerning because some applicants operate in conflict zones or countries governed by authoritarian regimes. Norad acknowledged that the attackers may have accessed the identities of individuals working in these environments, where disclosure of their involvement in international development projects could create security risks.
Torger Kjeldstad, Norad’s director of digitalization, described the incident as serious and said the organization had activated its crisis management team. External cybersecurity specialists have also been brought in to determine the extent of unauthorized access and identify the information obtained.
The agency has notified the owners of the 27 compromised accounts and is working to contact all registered portal users, along with the three organizations whose application materials were confirmed to have been affected.
Norad reported the incident to Norwegian police, the Norwegian Data Protection Authority, and the Norwegian National Security Authority (NSM).
The NSM indicated that the intrusion shares characteristics with other recent cyberattacks. However, authorities have not identified the perpetrators or established a connection to any particular hacking group.
The Grants Portal is used to collect funding applications rather than assess them or distribute financial assistance. Norad has not reported any unauthorized transfers of development funds resulting from the intrusion.
The investigation remains ongoing, with the agency expected to provide further information as it establishes the full scope of the breach. For now, the confirmed compromise of application documents and the possible exposure of thousands of user identities remain the principal concerns.