20,614 registered users had their names and email addresses stolen, Norad has confirmed — every single account on the agency's grant portal, the organization says.
Norad confirms the breach and the scale
Norad, Norway's national aid agency, acknowledged a cyber intrusion that it says affected all 20,614 registered users of its grant portal. Those users are connected to 12,511 organisations, and the agency confirmed that information from the grant applications for at least three organisations was “misdirected.” Norad cautioned that it may discover more affected applications as its investigation continues.
Torger Kjeldstad, director of digitalization at Norad, described the incident bluntly: “the attack is complex.” He told the agency had launched a crisis team and that external cybersecurity experts would be brought in to provide a detailed account of what the attackers accessed: “They will give us a detailed description of what information those who attacked the solution have gained access to.”
The grant portal: history, purpose and global reach
The portal, launched in 2017 and managed by Norad — which itself is part of Norway's Ministry of Foreign Affairs — handles applications from organisations worldwide. Norad cited recent case studies it supports to illustrate the range of work handled through the portal: support for independent, investigative journalism in Moldova; backing for Ukrainian children and prisoners of war; access to healthcare for transgender people worldwide; Kenyan incubators for innovative transport solutions; and delivering aid to Gaza.
Because the portal serves organisations across many countries and issue areas, Norad noted a particular concern that the stolen dataset could include names of applicants in “conflict areas and authoritarian states,” and it has not ruled that possibility out.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we build27 compromised accounts and the timeline the agency will not fully disclose
Norad said the intrusion stemmed from 27 compromised accounts that were then used to access the portal and extract data. The agency detected the intrusion on October 30, but Norad did not disclose how long attackers may have retained access, nor did it provide technical details about how the accounts were compromised.
Beyond the confirmed misdirection of at least three organisations' applications, Norad emphasised that its investigation is ongoing and that further findings are possible as external experts are engaged.
Norad's operational response and public guidance
Norad has formed a crisis team to manage the incident and stated publicly that it is engaging external cybersecurity specialists to establish a complete overview of what transpired. Kjeldstad also advised users on the portal's continued operation: “it should be safe” to continue using Norad's services while the agency probes the scope and origins of the attack.
At the same time, Norad withheld many operational details about the attack, and declined to say whether those whose names appear in the portal are also grant recipients.
What this means for investigative journalists, aid recipients, and partner organisations
- Independent investigative journalism in Moldova: Norad lists support for investigative journalism in Moldova among recent case studies handled through the portal; projects and applicants in that space could be represented among the portal’s records, and Norad has not ruled out inclusion of people in sensitive contexts.
- Organisations and individuals in conflict areas and authoritarian states: Norad explicitly flagged that names of applicants in “conflict areas and authoritarian states” may be in the stolen data, a detail that elevates potential safety and exposure concerns for applicants and contacts operating in high-risk environments.
- Partner organisations worldwide: With 12,511 organisations connected to the portal and at least three organisations’ applications confirmed misdirected, international NGOs and grantees will be watching Norad’s forensic findings for signs of what application data was taken and whether further misdirection occurred.
Norad's admission leaves several concrete, unanswered factual points: how the 27 accounts were initially compromised, how long the attackers had access, which specific application records beyond the three confirmed were exposed, and whether people in high-risk locations were included. The agency has said it is taking the incident “very seriously,” and has begun the steps it describes as necessary — detecting the intrusion, standing up a crisis team, and engaging outside cyber experts to map what the attackers accessed. For the 20,614 individuals and thousands of organisations now known to be affected, the coming days should produce the more granular answers Norad has pledged to secure.
