Security
Norad, Norway's aid agency, says hackers used 27 misused accounts to enter its grants portal and may have seen names and emails of all 20,614 users
Norway's aid agency Norad says attackers misused 27 accounts and may have seen all 20,614 users' names and emails; applications from three groups were taken.
Norad, the Norwegian Agency for Development Cooperation (not the North American air-defense command), says an attack on its grants portal may have exposed the names and email addresses of all 20,614 registered users. Attackers got in by misusing 27 user accounts, per Norad. The attack was found on Friday, October 30, and announced on Tuesday, November 3. Norad also says application information from at least three organizations outside Norway was extracted. The attackers are unknown.
The essentials
- How they got in: 27 user accounts were misused, Norad says. How those accounts were obtained has not been explained.
- What may be exposed: names and emails of all 20,614 users, from 12,511 organizations worldwide. Norad's wording is that the attackers may have had access.
- What was taken: Norad says application information from at least three organizations outside Norway was extracted, and the number could grow.
- What Norad did: it shut the portal immediately, informed the data protection authority and the national security authority, and filed a police report. The national security authority says the attack resembles other recent ones.
Why does this matter beyond spam?
The registry links people to aid organizations worldwide. Norad's digitalization director said it cannot rule out that names of applicants in conflict zones or authoritarian states were extracted, and an outside IT expert told Panorama Nyheter that a link to Norwegian aid can itself be a risk for such groups. Norad does not say which countries are involved.
What is the difference between 'accessed' and 'taken'?
Names and emails are described as possibly accessed, a cautious wording. Application information from three organizations is described as extracted. Norad says it is still mapping the scope and hired outside cybersecurity experts. Applications are assessed and funds paid outside the portal.
What is not established
- Who is behind the attack and why: unknown, per Norad.
- How the 27 accounts were compromised: not stated.
- Which three organizations are affected and what exactly was in their applications: not disclosed.
- When the portal will reopen: not stated in the coverage we saw.
Summary table
| Point | What is stated as of November 7, 2026 | Source |
|---|---|---|
| Detected | Friday, October 30, 2026 | Panorama Nyheter |
| Announced | Tuesday, November 3: 27 accounts misused; later, up to 20,614 users | Digi.no |
| Users in registry | 20,614 users from 12,511 organizations | Norad |
| Confirmed extraction | Application information from at least three organizations | Norad |
| Actions | Portal shut down; data authority, security authority and police notified | Norad |
FAQ
Is this the NORAD air-defense command?
No. It is the Norwegian Agency for Development Cooperation, which manages aid grants.
Were all 20,614 users' data stolen?
Norad says attackers may have had access to their names and emails; extraction is confirmed only for application information from at least three organizations.
Who did it?
Unknown. Norad says it does not know who is behind the attack.
Method and limits
Sources checked on November 7, 2026. Norad's notice was read as a search excerpt rather than in full, and the RuntimeWire summary, which cites an International Cyber Digest thread, was used only for context. This is not security advice.
Sources
- Norad: Norad utsatt for dataangrep (verified 2026-11-07)
- Panorama Nyheter: Norad rammet av dataangrep: 27 kontoer misbrukt (verified 2026-11-07)
- Digi.no: Norad har satt krisestab etter dataangrep (verified 2026-11-07)
- RuntimeWire: Norad says hackers may have accessed data on 20,614 aid grant portal users (verified 2026-11-07)
Spotted an error in this article? Report it · Our corrections policy
