Ransomware Attacks on Healthcare in the UAE
Ransomware groups have claimed 6 healthcare organisations in the United Arab Emirates since 2020, which is 5.4% of all attributed UAE claims. DarkVault accounts for 1 of them. The earliest claim in this sector was recorded on and the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE healthcare organisations
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| DarkVault | 1 | 16.7% | |
| Gunra | 1 | 16.7% | |
| KillSec | 1 | 16.7% | |
| LockBit 3.0 | 1 | 16.7% | |
| Medusa | 1 | 16.7% | |
| NightSpire | 1 | 16.7% | |
| Total | 6 | 100% |
How Healthcare claims spread across periods
UAE Healthcare recorded 6 claimed organisations, all of them between February 2024 and June 2025, with none in 2026.
Healthcare ranks seventh among UAE sectors with 6 claimed organisations
Healthcare ranks seventh of 13 UAE sectors, below the average of 8.6 claims per active sector. Six distinct groups appear here, one claim each. The sector has recorded nothing in 2026, which makes the shape of its record more interesting than its size.
Healthcare claims stop after June 2025
The sector recorded no claims across 2020 to 2023. Healthcare then saw 4 claims in 2024 and 2 in 2025. The partial year 2026 stands at zero so far.
That window is narrow. The first Healthcare claim was recorded on 12 February 2024 and the most recent on 9 June 2025. A gap in leak-site claims is not evidence that targeting stopped. Organisations that pay before publication never appear in this data at all.
What this means for UAE organisations
- Read the zero for 2026 as an absence of published claims, not as a measure of risk having fallen.
- Map your obligations under the UAE Personal Data Protection Law, which applies federally to any organisation processing personal data in the UAE.
- Establish how long clinical systems can run on paper, because that number decides what your recovery plan must actually achieve.
- Separate clinical devices from administrative systems, since medical equipment often runs software that cannot be updated on your schedule.
- Confirm that backups of patient records are held offline and that restoration has been tested against a real deadline.
- Treat the six groups involved as generalists, given that each appears once and none returned to the sector.
- Check that clinical suppliers and outsourced billing providers are covered by the same access review as staff accounts.
- Record who authorises a decision to suspend admissions, because that call is made under time pressure or not at all.
