Norad, the Norwegian Agency for Development Cooperation, said on 3 November 2026 that it had been targeted by a cyberattack in which the perpetrators may have gained access to the names and email addresses of the 20,614 registered users of its Grants Portal, and extracted information related to grant applications submitted by at least three organisations outside Norway; it says more organisations may be affected.

Norad says the attack was discovered on 30 October and that the attackers got into the portal by abusing 27 user accounts to log in; it has informed the owners of those accounts and is working to inform the 20,614 registered users and the three organisations it knows were affected. The portal has been in use since 2017, has users from 12,511 organisations, and is used by Norway's Ministry of Foreign Affairs and Norad for development-aid funding applications.

Norad says the portal was closed down immediately, that it does not yet know who is behind the attack, that Norway's National Security Authority (NSM) has confirmed the attack shares characteristics with other recent cyberattacks, and that it cannot rule out that names of applicants operating in conflict zones and authoritarian states were accessed.

It has notified the Norwegian Data Protection Authority (Datatilsynet) and NSM, reported the incident to police and is engaging external cybersecurity experts. (source: Norad)

Correction (06 Nov 2026): removed Help Net Security as a secondary source; Help Net is not on CyberStack's allowlist and the card's figures come from Norad's own statement. (source: Norad)