Ransomware and Data-Theft Claims in Bahrain: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in Bahrain.

1. Bahrain has the smallest record of the six Gulf markets we track. Three observed claims against 45 in the UAE, 17 in Saudi Arabia, seven in Oman, six in Kuwait, and five in Qatar, though visibility differs by country. By our count Bahrain had one claim in 2022, two in 2023, none in 2024, and one in 2025. A series this small supports little more than saying the record is thin.
2. Three groups, three sectors, no repeat. A car-retail group (INC Ransom, 2 February), a private hospital (Payload, 15 March), and a resort manager (DragonForce, 12 June). None of the three groups made a second Bahraini claim in the window.
3. The leak sites have been quiet since June. The last claim is dated 12 June, and Q3 has none. Forum offers continued in July, so a quiet leak-site record is not a quiet market.
4. Forum sellers recycle. The same offer of 200 GB from a national security body was posted by two different handles seven months apart, and a hotel was offered by two near-identically named handles within five days. Treat repeated offers as reuse, not as fresh breaches, until verified.
5. The war shows up as disruption, not ransomware. Iranian strikes hit Bahrain from 28 February, and a pro-Iran group claimed 15 denial-of-service attacks on Bahraini targets in two days in March. Our leak-site data holds no war-aligned claim in Bahrain. Defend against the groups' behavior, not just the local headline.

We rate the risk to Bahraini mid-market commercial firms and private healthcare as Medium and steady. For government bodies and hospitality operators we rate it Elevated, driven by forum access offers and the war context. These are our assessments, built on a very small record.

1. Scope, and what the numbers can bear

This report covers claims naming Bahraini organizations that were published between 1 January and 30 September 2026. We found no new Bahraini leak-site claim between 1 and 10 October. All three claims are financially motivated extortion claims. A company listed twice for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, so firms headquartered elsewhere with a Bahraini office are not counted. Visibility differs by country, so the counts are not complete incident totals and are not a like-for-like measure of national risk.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger. With counts this small, a single incident changes the picture.
• A group’s claim is not proof of compromise. We have not independently verified any published dataset.
• Attributing a victim to a country is imperfect, and some firms operate across the region. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker: a seller of ready-made entry into a network.

2. Timeline: three claims, then a long gap

Two claims landed in Q1, five weeks apart, and one in June. Nothing has appeared since. The first claim, on 2 February, predates the war by almost four weeks, so the war does not explain the record. With three data points, dates alone cannot tell us whether a group is active in the market or whether we simply saw three unrelated listings.

The war context is physical, and the cyber side is mostly disruption. According to the public timeline, Iranian missile and drone strikes began hitting Bahrain on 28 February, including the Manama district of Juffair, where the US Fifth Fleet is headquartered, and strikes continued into June. A SOCRadar profile of the pro-Iran DDoS group DieNet counts 15 attack claims against Bahraini targets over 2 and 3 March, mostly government portals, including an airport, a telecom operator, and a social-insurance body. The same profile says DieNet often inflates its claims. Local press citing a vendor tally says Bahrain's share of regional denial-of-service incidents fell from 19% in Q1 to 6% in Q2. Denial-of-service claims are not ransomware, so we keep them out of our counts, and our leak-site data holds no war-aligned claim in Bahrain.

3. The groups at a glance

Three groups made one claim each, so no group has a pattern here. INC Ransom and DragonForce both also work the UAE and Saudi Arabia, while Payload appears in Bahrain, the UAE, and Qatar but not in our Saudi data. Earlier years brought other names: BlackByte, BianLian, Cloak, and Direwolf.

4. Who is being hit

Our own classification of the three claims. Each claim is counted once.

• Automotive retail: 1. H-Behbehani Brothers, a group established in 1957 that represents several car brands.
• Healthcare: 1. Royal Bahrain Hospital, a 70-bed private hospital.
• Hospitality management: 1. The DRM, a resort-management company.

There are no government bodies, banks, or manufacturers on the leak-site list. Bahrain's public sector appears on the forums instead, in the form of claimed data from a security body. The hospital claim is the most serious of the three, because healthcare downtime has a direct clinical cost and patient data is highly sensitive.

In a market this small, one hospital claim is a third of the record.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. A private hospital with a deadline (Payload, 15 March)

Claim. On 15 March Payload listed Royal Bahrain Hospital, claiming 110 GB and setting a deadline of 23 March. Security press picked it up within two days.
Reading. Payload then claimed a UAE conglomerate on 28 March and a Qatari law firm on 20 April, so Bahrain was the first of three Gulf states in 36 days. That is quick geographic spread for a new brand, consistent with affiliates reusing the same access sources across several countries, but the evidence does not establish a shared intrusion, supplier, or vector. A hospital holds patient, insurance, and staff records, and a deadline suggests the group expected a negotiation.
Confidence. High on the dates. Moderate on the shared access explanation, which is our inference.

Case 2. A car-retail group (INC Ransom, 2 February)

Claim. On 2 February INC Ransom listed H-Behbehani Brothers, an automotive retail group established in 1957. We saw no data volume.
Reading. Dealer groups hold customer identity documents, financing and insurance details, and service histories, which makes the data useful for fraud even without an intrusion into the manufacturers' systems. INC Ransom has five claims in the UAE and two in the Kingdom, so the claim fits a regional pattern of mid-market firms.
Confidence. Moderate that the listing was posted as described. Low on what was taken.

Case 3. A resort manager (DragonForce, 12 June)

Claim. On 12 June DragonForce listed The DRM, a company that manages resorts. We saw no data volume.
Reading. Resort managers hold guest identity and payment details, staff records, and contracts with owners and operators. DragonForce runs an affiliate model, and its main Gulf footprint is in the UAE, with one claim in the Kingdom, so this is its first Bahraini claim in our record. Hospitality also appears among the forum offers in July, which we note without linking them.
Confidence. Moderate that the listing exists. Low on the contents.

Case 4. The same 200 GB claim, twice (July 2025 and February 2026)

Claim. On 29 July 2025 one forum handle offered 200 GB said to come from a national security body. On 24 February 2026 a different handle posted the same headline: 200 GB from the same body.
Reading. The same figure from two handles seven months apart suggests recycling, resale, or a copied listing rather than two breaches. The second handle also posted a Kuwaiti airline offer on 10 March, which links two of our markets through one seller. Government bodies should check whether any sample matches their data and how old it is, and treat the claim as a verification task.
Confidence. High that both posts exist. Low that either describes a real breach.

Case 5. A hotel offered twice in five days (25 and 30 July)

Claim. On 25 July a Telegram post under one handle named the domain of a Bahrain hotel. On 30 July a forum post under a near-identically named handle offered FortiGate access for the same hotel.
Reading. The two handles are probably one operator, and a firewall credential or VPN access offer is the kind of listing a ransomware affiliate buys. If accurate, the hotel's exposure sits at the network edge, so the first checks are firewall firmware, VPN accounts without MFA, and exposed management interfaces. A hotel holds guest identity and payment data. This is an access listing, not a claim of data theft.
Confidence. High that the posts exist. Low that the access works.

Case 6. The March denial-of-service wave

Claim. A pro-Iran group claimed 15 denial-of-service attacks on Bahraini targets on 2 and 3 March, mostly government portals and including an airport, a telecom operator, and a social-insurance body.
Reading. These attacks were timed to the strikes and do not involve stolen data or ransom. Their value to the attacker is attention and disruption of public services. The group has a record of overstating its claims, so some of the 15 may not have caused outages. The lesson for operators is capacity and filtering, not a ransomware playbook.
Confidence. High that the claims were made. Low on their effect.

6. Active threat actors: presence, motivation, and TTPs

Three actors made all three claims. Their public technical detail comes from global incident reporting, not from the Bahraini cases. We have no incident-level evidence from Bahraini victims, so read the tradecraft below as known behavior of each group in general, not proof of what happened to a named Bahraini firm. Technique IDs refer to MITRE ATT&CK.

Summary: motive and presence

What the actors share

Group names differ, but their methods overlap. In publicly documented worldwide activity, all three steal data to publish before or alongside encryption, and some also disable security tools. That does not show these methods were used in the Bahraini claims in this report.

Marks reflect public reporting on each group worldwide, not Bahraini incident evidence.

Actor profiles

Earlier groups in the Bahraini record

• BlackByte. An IT and telecom solutions provider in October 2022.
• BianLian and Cloak. In 2023, a regional shipbuilding and repair yard and a power company.
• Direwolf. A real-estate investment company in spring 2025.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. We reviewed five Bahrain-targeted posts, four of them published between 24 February and 30 July 2026 and one from July 2025. That is a very short sample, so we read it as a snapshot, not a trend. We name no victims here, because the claims are unverified and naming a target may amplify an unproven claim.

What the five posts target

• Government and security: 2. The 200 GB offer from a national security body, posted in July 2025 and again in February 2026.
• Hospitality: 2. A hotel domain on Telegram and a FortiGate access offer for the same hotel (Case 5).
• Media and web: 1. A 4 March offer of administrator access to the website of a showroom.

Who is posting

Five handles made five posts, one each. Two of them have near-identical names and are probably one operator. One handle, TheAshborn, also appears in our Kuwaiti sample, which links the two markets through a single seller.

Why this matters for ransomware risk

Edge-device access sold on forums is the front end of the ransomware chain. A leak-site record of three claims says little about how much access is on sale, and we cannot link any listing to any claim, and we do not. The reason to watch forums is the interval between a sale and a public claim, which is usually days to weeks.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. For claims about government and security bodies, verify before you escalate. Check whether the data is old or public, whether it matches your records, and whether the poster offers sample files.

8. Update outside the report window: October 2026

We found no new Bahrain-linked leak-site claim between 1 and 10 October. The most recent one is the 12 June claim against a resort manager, about four months before this report. We do not read the gap as safety: the record is too small to show a trend, and forum offers continued in July.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public regional and vendor reporting. The consistent picture:

• Exposed edge devices and valid accounts. Firewall and VPN access offers, such as the hotel listing, are the entry route that vendors describe most often for the groups in this report.
• Bought access and stolen credentials. Forum sellers offer access and database extracts cheaply, and combolists feed credential stuffing, account takeover, and business email compromise.
• Rented disruption. The March denial-of-service wave relied on rented infrastructure, not on getting inside, so the defense is capacity and filtering.

10. The regulatory frame

Bahrain’s Personal Data Protection Law is Law No. 30 of 2018, in force since 1 August 2019 and supervised by the Personal Data Protection Authority. Law-firm commentary says a controller that becomes aware of a breach must notify the Authority within 72 hours, with a documented justification if the notice is late, and must inform affected individuals where the risk is high. We have not checked these points against the text of the law. Bahrain’s National Cyber Security Center also publishes cybersecurity controls for critical national infrastructure sectors, and we have not reviewed them. Regulated financial institutions answer to the Central Bank of Bahrain in addition, and we have not reviewed its rules. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. Leak-site volume stays very low. We expect zero to three claims in the quarter, a low-confidence range resting on a record of three, which a single group could change.
2. Mid-market and healthcare stay the likely targets. All three claims named private firms of that kind, and the groups involved all work the UAE.
3. Forum access offers will surface as claims. Some forum-listed Bahraini access may reappear as leak-site victims within weeks, and hospitality and government offers deserve verification now.
4. The war stream is a wildcard. Denial-of-service waves followed the strikes and can return quickly with any escalation.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway, including Fortinet devices. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse. Hospitality and government bodies should do this first, given Cases 4 and 5.
3. Rank your vendors by what they hold. Hospitality managers, dealers, healthcare partners, and IT providers in your supply chain hold identity and payment data. Ask each for MFA, EDR, and offline-backup evidence.
4. Test offline backups for clinical systems. Healthcare operators should confirm that records and imaging systems can be restored without the production network.
5. Prepare for denial of service. Government, aviation, and telecom portals should confirm upstream filtering and scrubbing arrangements with their providers before the next escalation.
6. Rehearse the double-extortion call. Know who notifies the Authority, who briefs the board, and who decides on negotiation. Write it down and test it.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• Check Point Research, The State of Ransomware Q1 2026
• UpGuard, Payload claims data breach on Royal Bahrain Hospital
• Proven Data, Payload ransomware variant analysis
• 2026 Iranian strikes on Bahrain (event timeline)
• SOCRadar, Dark Web Profile: DieNet
• The Hacker News, 149 hacktivist DDoS attacks hit 110 organizations in 16 countries
• Gulf Daily News, Hacktivists behind 83% of Q2 DDoS attacks in MENA
• Bahrain National Cyber Security Center, CNI cybersecurity controls
• DLA Piper, Data protection laws in Bahrain (secondary source)
• Lex Mundi, Bahrain data privacy guide (secondary source)

Sources are linked in their original language.