Norad, Norway’s development cooperation agency, has disclosed an attack discovered on October 30, 2026 against its Grants Portal. Its statement describes abuse of 27 accounts. Names and email addresses of 20,614 users may have been accessed, while application documents from at least three organisations were compromised. For partner nonprofits, the consequences may extend beyond unwanted email.
Keep the two populations separate
Accounts used to enter the portal and people whose information may be accessible are different groups. Panorama Nyheter documented the initial findings and the portal’s role before the potential scope became clearer. An organisation should establish whether a notice concerns its login, staff contact details or a submitted application. That distinction helps identify who needs to be informed.
Application records are distinct from payments
Norad says the portal does not assess applications or disburse funding. The incident should therefore not be described as theft of grant payments. Application attachments can nevertheless be confidential in their own right. The number of affected application files cannot be inferred from the number of registered users.
Assess the implications for partners
Help Net Security highlights the position of applicants working in conflict zones or authoritarian states. A practical assessment should consider what an application connects: a person, an organisation and a project. Where partners operate in sensitive circumstances, have the notice reviewed by the person responsible for their safety before circulating it widely. Avoid adding to the exposure by sharing potentially affected names in public channels.
Regain control of the submission account
Confirm Norad notices through an established channel with the agency. If your organisation receives a replacement instruction, use the official portal or procedure and retain records useful to the investigation. Assign an account owner and check which staff still need access. The finding that accounts were abused does not establish whether phishing, password reuse or another method enabled entry.
The link with Soclyde
A small nonprofit needs to locate its grant-portal credentials without placing the password in every project folder. Soclyde organises those credentials in an encrypted vault on the user’s devices, with sharing available in Premium. It cannot remove documents already exposed at Norad. Portal permissions and account changes must still be managed with the agency.
Takeaway
Handle abused access separately from potentially exposed information. For Norad applicants, the confidentiality of people and application records matters alongside portal recovery. Our secure password guide explains how to organise stronger account practices.
