Ransomware Attacks on Retail and E-Commerce in the UAE
Ransomware groups have claimed 10 retail and e-commerce organisations in the United Arab Emirates since 2020, which is 8.9% of all attributed UAE claims. Coinbase Cartel accounts for 2 of them. The earliest claim in this sector was recorded on and the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE retail and e-commerce organisations
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Coinbase Cartel | 2 | 20% | |
| Everest | 2 | 20% | |
| Stormous | 2 | 20% | |
| Blackshrantac | 1 | 10% | |
| BQTLock | 1 | 10% | |
| LockBit 3.0 | 1 | 10% | |
| The Gentlemen | 1 | 10% | |
| Total | 10 | 100% |
How Retail and E-Commerce claims spread across periods
UAE Retail and E-Commerce holds 10 claimed organisations, with 7 of them falling in 2025 and the partial year 2026 alone.
Retail and E-Commerce ranks fifth among UAE sectors
Retail and E-Commerce ranks fifth of 13 UAE sectors, above the average of 8.6 claims per active sector. Seven distinct groups appear here. Three of those groups account for 2 claims each, a tighter concentration than most UAE sectors show.
Retail claims were flat until 2025, then rose sharply
Retail and E-Commerce recorded 1 claim across 2020 to 2022, 1 in 2023 and 1 in 2024. The figure then jumped to 4 in 2025 and stands at 3 for the partial year 2026. Seven of the 10 claims on record therefore fall in the last two periods.
Coinbase Cartel, Everest and Stormous each account for 2 claimed organisations here. Seven distinct groups appear in the sector in total. Those three therefore represent a tighter concentration than most UAE sectors show. That makes their published methods worth studying directly rather than in the abstract.
What this means for UAE organisations
- Treat customer payment and identity records as the primary exposure, because retail systems hold both at volume.
- Confirm your breach notification path under the UAE Personal Data Protection Law before trading peaks, not during one.
- Test payment and order systems separately from corporate systems, since the two often share credentials without sharing controls.
- Study the three groups with 2 claims each, because repeat activity gives more signal than a single appearance does.
- Rehearse trading through an outage, given that downtime in this sector converts to lost revenue within hours.
- Check that seasonal and contractor accounts are removed on schedule, since retail headcount moves faster than access reviews.
- Confirm that supplier and marketplace integrations hold access under the same review cycle as your own staff accounts.
