Norway’s foreign aid directorate lost the details of every person registered on its grant portal. Norad has confirmed that all 20,614 account holders were affected, spread across 12,511 organisations.
Names and email addresses were taken. The agency also said application material belonging to at least three organisations was “misdirected” and that the number may climb as the investigation runs.
How the intruders got in
Twenty-seven portal accounts were compromised and then used to reach the underlying data. Norad spotted the activity on October 30 and has not said how long the attackers held access before that. It has brought in outside security specialists to reconstruct the intrusion.
Torger Kjeldstad, the director of digitalisation, called the attack complex and said a crisis team is in place. He told users it should be safe to keep using the agency’s services while the review continues.
Why the names matter more than the count
The portal, live since 2017, takes applications from organisations worldwide, including work on independent journalism in Moldova and support for Ukrainian children and prisoners of war. Norad declined to rule out that applicants based in conflict zones or authoritarian states appear in the stolen records.
For most of those applicants, an email address is not a neutral identifier. It links a named person to a funding request that a hostile government may treat as evidence.
Norad has not named the attackers or described their motive, and has not said whether the exposed accounts showed signs of misuse before October 30.
