{"id":"CMP-202611-ddjyrv","kind":"campaign","aliases":[],"related":[],"title":"Norad (Norway's aid agency) grant portal breached: names and emails of 20,614 grant applicants from 12,511 organisations worldwide exposed, attackers logged in with 27 abused accounts","description":null,"summary":"Norad, Norway's development aid agency, says attackers got into its grant portal (Tilskuddsportalen, used by Norway's foreign ministry and Norad for aid-project grant applications) by logging in with 27 misused user accounts. The attack was discovered on Friday 30 Oct 2026. Names and email addresses of 20,614 registered users from 12,511 organisations worldwide may have been accessed. Applications and attachments of at least three organisations outside Norway were taken, and there may be more. Norad cannot rule out that names of applicants in conflict zones and authoritarian states were taken. Who is behind it is unknown; Norway's NSM says it resembles other recent attacks. The portal was shut down, and the police, the data protection authority and NSM were notified. How the 27 accounts were compromised is unknown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T23:48:40+00:00","products":[{"name":"Norad Tilskuddsportalen (grant portal)","fixed":[],"vendor":"Norad"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Your organisation has an account on Norad's Tilskuddsportalen (grant portal), or has applied for Norad or Norwegian foreign ministry grants. Watch for emails that claim to be from Norad or the Norwegian foreign ministry, or mention your grant application, and ask you to log in, open attachments or change bank details. No attacker sender domains or other indicators have been published.","fix":"If you have a Tilskuddsportalen account: change its password and any reused passwords, and wait for Norad's notification. Treat unexpected grant-related emails as possible phishing and check them with Norad directly (presse@norad.no / postmottak@norad.no, +47 22 30 40 50). Organisations with staff in conflict areas or authoritarian states should assess their exposure, since names may have been taken.","status":"open","published_at":null,"first_seen_at":"2026-11-04T23:48:40+00:00","triaged_at":"2026-11-04T23:48:40+00:00","updated_at":"2026-11-04T23:49:45+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':31A '12':18A,96B '20':13A,91B '2026':85B '27':27A,73B,170B '30':83B '511':19A,97B '614':14A,92B 'abus':28A 'access':103B 'account':29A,76B,171B 'address':89B 'agenc':5A,46B 'aid':4A,45B,65B 'aid-project':64B 'applic':16A,68B,104B,128B 'attach':106B 'attack':23A,48B,78B,151B 'author':163B 'authoritarian':133B 'behind':139B 'breach':8A 'campaign':37B 'cannot':122B 'cmp':30A 'compromis':173B 'conflict':130B 'data':161B 'ddjyrv':32A 'develop':44B 'discov':80B 'earli':39B 'early-warn':38B 'email':11A,88B 'expos':22A 'foreign':59B 'friday':82B 'got':49B 'grant':6A,15A,35A,52B,67B 'least':109B 'log':24A,70B 'may':100B,118B 'ministri':60B 'misus':74B 'name':9A,86B,126B 'norad':1A,33A,41B,62B,121B 'norway':2A,42B,57B,113B,143B 'notifi':167B 'nsm':145B,165B 'oct':84B 'organis':20A,98B,111B 'outsid':112B 'polic':159B 'portal':7A,36A,53B,153B 'project':66B 'protect':162B 'recent':150B 'regist':93B 'resembl':148B 'rule':123B 'say':47B,146B 'shut':155B 'state':134B 'taken':115B,136B 'three':110B 'tilskuddsportalen':34A,54B 'unknown':142B,175B 'use':55B 'user':75B,94B 'warn':40B 'worldwid':21A,99B 'zone':131B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["noradtilskuddsportalengrantportal","tilskuddsportalengrantportal"],"ptokens":["grant","norad","portal","tilskuddsportalen"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"breach","first_public_at":"2026-11-03T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ddjyrv","url":"https://www.norad.no/aktuelt/nyheter/2026/norad-utsatt-for-dataangrep/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T23:48:40+00:00","fetched_at":"2026-11-04T23:48:40+00:00","note":null,"cites":["https://www.norad.no/aktuelt/nyheter/2026/norad-utsatt-for-dataangrep/"]}],"documents":[{"id":71302,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzjirqbd4s27","title":"@campuscodi.risky.biz: Hackers have breached Norway's international aid agency and stolen the personal ","kind":"post","source":"bluesky","publisher":null,"text":"Hackers have breached Norway's international aid agency and stolen the personal data of more than 20,000 grant applicants\n\nwww.norad.no/aktuelt/nyhe...\nhttps://www.norad.no/aktuelt/nyheter/2026/norad-utsatt-for-dataangrep/\n\nlikes 1 reposts 0","published_at":"2026-11-04T23:24:48+00:00","relation":"describes","confidence":null,"note":null},{"id":71337,"url":"https://www.norad.no/aktuelt/nyheter/2026/norad-utsatt-for-dataangrep/","title":"Norad utsatt for dataangrep","kind":"vendor","source":"analyst","publisher":null,"text":"Norad (Norwegian Agency for Development Cooperation) grant portal (Tilskuddsportalen) attacked; discovered Friday 30 Oct 2026. Attackers logged in by misusing 27 user accounts. They may have accessed names and email addresses of 20,614 registered users from 12,511 organisations worldwide; applications and attachments of at least three organisations outside Norway taken, possibly more. Norad cannot rule out that names of applicants in conflict areas and authoritarian states were taken. Perpetrator unknown; NSM says it resembles other recent attacks. Portal shut down immediately; Datatilsynet and NSM notified, police report filed. Owners of the 27 abused accounts informed; Norad is informing the 20,614 users.","published_at":"2026-11-03T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}