Hackers Claim 200GB Data Theft From Dubai’s DIFC and Demand $5 Million

A ransomware group going by the name Reze claims to have stolen 200 gigabytes of data from the Dubai International Financial Center (DIFC), a major financial hub in Dubai.

The group demands $5 million or else they’ll publish the entire haul. An alert also links a second group, BBK, to the attack. However, nobody has proved any of this yet.

Details of the Hackers’ Claim

According to Reze, the database contains 432,178 email addresses, 324,239 phone numbers and 391,382 names. The organization has also compiled 37,352 passport entries, Emirates ID numbers along with several thousand internal files.

Security firm Brinztech reported the claim on October 21. Its alert repeats the email, phone and name figures in rounded form.

The two alerts differ on a few points. One came from a hacking forum before the site went down. It says the group posted samples and gave DIFC 10 days to respond. It is also named BBK.

Brinztech, though, does not mention the ransom, the passport count or BBK. In fact, it says the attackers have not shared raw proof or explained how they got in. So the reports disagree on whether real samples exist. For now, treat that point as open.

Also, the forum that carried the original post went offline soon after. As a result, outsiders struggle to check what the group posted.

Why People Should be Skeptical About the Claim

Ransomware groups often inflate their claims. For example, in 2024, the LockBit gang said it had hacked the U.S. Federal Reserve. Instead, it had posted data from a single bank, Evolve Bank & Trust. Evolve confirmed an incident, but the Fed claim fell apart.

Brinztech makes a similar point. It says extortion groups often publish big numbers to cause panic and force talks. It also describes Reze as a newly active group. That means Reze has little track record to judge.

Nonetheless, these numbers need to be considered. The statistics are accurate, and places like the DIFC have access to sensitive information. Brinztech notes that such places store executive directories and investor details, which makes them tempting targets.

Separately, the UAE’s cyber security chief said last month that a hacker demanded $5 million. The target was a private firm that supports a government sector. A cybercriminal has threatened to release the stolen data on the dark web.

The authorities stated that coordinated efforts from both government departments and the private sector prevented the leak. It is still unknown what organization was behind it, but it is not linked to DIFC. The identical ransom amount shows the frequency of extortion in the area.

Why a Claim Involving the DIFC Matters

The DIFC is a financial free zone in Dubai. Dubai Financial Services Authority supervises the companies operating in the financial zone. By 2025, there were over 1,600 fintech companies in the area, according to a recent DIFC report. This means that a breach will affect numerous firms and people associated with them.

DIFC runs its own data protection law. When a breach happens, the company in charge must tell the Commissioner of Data Protection as soon as practicable. It must also warn affected people when the risk to them is high. Meanwhile, all firms under the agency’s oversight are expected to report serious cyber incidents without delay.

The watchdog tightened the rules in July 2025. Since then, people can ask DIFC courts for compensation if a breach harms them. Therefore, a confirmed leak could bring legal claims as well as a regulatory review. As of Thursday, October 22, our searches found no public statement from DIFC. 

Potential Risks of the Stolen Data

Passports and Emirates ID details are very crucial because criminals can use them to open accounts without the real owner’s knowledge. They can also use them to bypass identity checks or impersonate the owner.

In a separate incident, a hacker claimed in April this year to have stolen UAE investor data, including Golden Visa records, raising similar concerns about exposed sensitive identity information.

Also, phone numbers and email addresses come in handy for creating phishing emails. Even outdated personal information may serve as a source for future fraudsters.

How to Avoid Such Risks

If you’ve had any prior dealings with a firm under the DIFC, it’ll be wise to stay alert. And take a few steps to protect yourself. Never click links attached to unexpected messages and always monitor your bank statements so you catch odd charges on time.

Also, call a company back on a number you trust before you share any details. Scammers have posed as DIFC before. The regulator once warned about a fake prize offer in its name. Firms should act too. Brinztech advises checking logs for unusual data transfers, locking down access with multi-factor sign-in, and getting response plans ready.

Three things will tell us more. First, whether DIFC confirms or denies the breach. Second, whether Reze releases files when its 10-day deadline ends. Third, whether any leaked samples match real DIFC records. For now, the claim is still unverified. However, it still deserves attention because it involves personal information, which, if real, can fuel all sorts of scams.