UAE Ransomware Attacks in 2020–2022

The 2020 to 2022 period holds 7 claimed UAE organisations, the baseline against which every later rise on this tracker is measured.

The 2020 to 2022 period holds 7 claimed UAE organisations

These three years are grouped into one page because each single year holds too few claims to describe a pattern. Together they form the baseline against which every later rise on this tracker is measured. The groups leading this period have almost all stopped claiming UAE targets since.

The earliest UAE claims came from groups that no longer operate

LockBit 2.0 and Snatch each account for 2 claimed organisations in this period. LockBit 3.0 and MedusaLocker each account for 1. Professional Services carried 3 claims, Financial Services 2, and Government and Defense and Retail and E-Commerce 1 each.

The named groups matter less than the shape. Two of the most active operations of this period have recorded no UAE claims since 2022. Attacker populations turn over faster than defensive programmes do, which is why this site tracks sectors alongside groups.

What this means for UAE organisations

1. Use this period as a baseline rather than as a threat picture, because the groups active then have largely stopped claiming UAE targets.
2. Compare later periods against 7 claims when judging whether a rise is meaningful.
3. Avoid building a defence around named groups, given how completely the leading names changed after 2022.
4. Note that Professional Services led even at this early stage with 3 claims, and has led every period since.
5. Treat older counts as understated, because leak-site monitoring coverage was thinner in these years than it is now.
6. Read the whole period with the same caution the methodology page sets out, since a claim is an attacker assertion rather than a confirmed breach.
7. Note that 7 claims across three years sits below what single later years record, which is the scale of the change since.