UAE Data Breaches in September 2026: 7 Incidents, a 4TB Ministry of Interior Claim, and What It Means
Seven UAE data breaches surfaced on dark web forums in September 2026, including a 4TB Ministry of Interior claim. What leaked, who claimed it, what to do.
September was a heavy month for the UAE. Seven distinct incidents involving Emirati organisations surfaced on criminal forums between 7 and 29 September 2026, ending with two separate actors claiming the same four-terabyte haul from the Ministry of Interior.
The Ministry of Interior claim, and the number that undermines it
On 28 September an actor using the handle @x_tcp claimed to have taken 4TB from UAE Ministry of Interior servers: the Emirates ID database, passport records, biometrics and driving licence data covering citizens, residents and visitors. A day later a second actor, Hackers Syris, posted a near-identical claim on the same forum, adding traffic violation records.
The second listing priced it at $1,000.
That price is the most informative detail in the whole month. A complete national biometric and identity set for a wealthy country is not a thousand-dollar asset. Either the data is not what the listing says it is, or it is recycled material being relabelled for a quick sale, or the seller needs to move it faster than its value suggests. Two actors advertising the same volume within twenty-four hours points the same way: co-claiming is common when one underlying source is being passed around and renamed.
We assess with moderate confidence that the 4TB figure overstates what the sellers actually hold. We stop short of calling it fabricated: sample credentials attributed to the same actor appeared separately on 29 September, and samples are the one thing that costs a bluffer something to produce.
The first of two claims against the same ministry in twenty-four hours. Crop the address bar before publishing.
Nobody broke the perimeter
Strip out the ministry claim and a consistent pattern remains across the other six incidents. None of them describe an exploited vulnerability.
Administrative panel access → a Dubai luxury car dealership, listed on 7 September by ZentinelTeam, exposing seller and vehicle records.
A third party → the Noon e-commerce platform, 40 million lines, breached through a supplier rather than directly. The thread concerns the group's Egyptian arm, though ownership is Saudi and Emirati.
A ransom deadline that expired → GoreSpiders published 154,944 user accounts from iChargePoint.com, a UAE power bank rental service, one week after the company did not pay.
A bulk reseller → on 25 September @VeritasCarpeDiem listed Emirati investor and casino player records as one line item among Switzerland, India, Germany and Turkey. The UAE was not the target here so much as inventory.
Two more rounded out the month: a 4 million record database attributed to Dubai Smart Travel, a platform handling digital payments and border crossing vouchers, and a 49GB database taken from the real estate firm Alnair.ae.
The Alnair case deserves separate attention
The actor behind the Alnair.ae listing, DaOnlySpark, did not extort the company. They copied 49GB and destroyed the original. No negotiation window, no payment demand, no leak-site countdown.
Most ransomware tabletops stop at the payment decision. This incident never offered one. For a property firm the exposure is transaction history and client records with no copy left behind, and the only control that helps is a restore someone has actually run.
What to do with this
Four actions, in the order we would take them.
Treat Emirates ID and passport images as compromised for verification purposes. Whether or not the ministry claim holds, identity documents from the region circulate widely enough that a document image alone should not satisfy a KYC or account recovery check. Add a second factor that is not a photograph.
List every third party with database access, then check what they expose. The Noon incident and several Egyptian university breaches the same month share this route. Your supplier's security posture is your attack surface.
Find your administrative panels from the outside. The dealership listing was panel access, not an exploit. Enumerate what answers on your public IP ranges and put anything administrative behind an identity-aware proxy.
Test a restore this quarter. Alnair is the argument. A backup you have never restored is a belief, not a control.
The deadline was real. A week after it expired, 154,944 accounts were free to download.
The trend worth watching
Every one of these incidents reached a criminal forum before it reached the affected organisation’s customers. In three of the seven, the first public signal was a sales listing — which is a warning only for whoever happens to be watching the place it was posted.
For organisations operating in the Emirates, that is the uncomfortable part. The exposure was advertised in public for days. Whether that counted as early warning depended entirely on who was looking.