Ransomware Attacks on Financial Services in the UAE
Ransomware groups have claimed 12 financial services organisations in the United Arab Emirates since 2020, which is 10.7% of all attributed UAE claims. Stormous accounts for 3 of them. The earliest claim in this sector was recorded on and the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE financial services organisations
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Stormous | 3 | 25% | |
| Coinbase Cartel | 2 | 16.7% | |
| Auditteam | 1 | 8.3% | |
| DragonForce | 1 | 8.3% | |
| KillSec | 1 | 8.3% | |
| Medusa | 1 | 8.3% | |
| MedusaLocker | 1 | 8.3% | |
| Ransomhouse | 1 | 8.3% | |
| Snatch | 1 | 8.3% | |
| Total | 12 | 100% |
How Financial Services claims spread across periods
Financial Services holds 12 claimed UAE organisations from 9 separate groups, the widest spread of any sector on this tracker.
Financial Services ranks fourth among UAE sectors with 12 claimed organisations
Financial Services sits fourth of 13 UAE sectors and carries 10.7% of all attributed claims. The count runs above the average of 8.6 claims per active sector. It also holds the longest record of any sector here.
The Financial Services record runs longer than any other sector
Leak-site monitoring recorded the first Financial Services claim against a UAE organisation on 27 January 2022. The most recent was recorded on 13 October 2026. No other sector on this tracker opens that early.
The distribution by period is uneven. The sector shows 2 claims across 2020 to 2022 and 2 in 2023. It recorded nothing in 2024, then 4 claims in 2025 and 4 in the partial year 2026.
That empty year is the detail worth holding. A sector can record nothing for twelve months. It can then return to its previous rate, as this sector did. A quiet year is not a trend.
What this means for UAE organisations
- Nine distinct groups appear in this record, the widest spread on the tracker, so no single actor describes the threat.
- Establish whether DFSA Technology and Risk Management rules apply, which they do for firms authorised in the DIFC.
- Read a quiet year as a gap in the record rather than as an improvement in posture.
- Map obligations under the UAE Personal Data Protection Law, which reaches client records held outside the free zones.
- Compare against Professional Services, which supplies this sector and carries 24 claims.
Twelve claims across nine groups and five years is thin for modelling but long enough to read as a record. Watch the rate rather than the total.
