Ransomware and Data-Theft Claims in Egypt: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in Egypt, and for any firm that works with Egyptian suppliers or sells into the market.

1. Egypt has the highest observed volume in our dataset. We observed 36 Egypt-linked claims in the first nine months of 2026, split 9, 17, and 10 by quarter. That is almost twice the 19 across the five Maghreb countries combined, and 43% of the 83 across our six Gulf markets. These are observed volumes in our own collection, and collection coverage, country tagging, and deduplication may differ between countries, so the ranking is not a measure of real incidence or national prevalence.
2. The targets are mid-sized industrial and commercial groups. Manufacturing and food (8), real estate and construction (7), retail and distribution (4), and hospitality and travel (4) account for 23 of the 36 claims (64%). Five claims (14%) name government bodies or state-owned firms, among them an agriculture ministry, a national oil distributor, and the state airports company.
3. Three oil and gas companies were named in 15 weeks. Payload listed a gas producer on 8 April, APT73 a state-owned refiner on 27 April, and Krybit a national fuel distributor on 23 July. Different groups, one sector.
4. Country filters undercount Egypt. The main tracker lists 28 Egypt-tagged entries to 30 September. Our cleaned count is 36, because five of Krybit's six Egyptian victims are tagged to the US, Saudi Arabia, India, Kenya, or no country, and a second tracker lists five more. Anyone who monitors by a country filter alone will miss more than a quarter of the claims.
5. October brought universities, and the data-protection grace period ends on 31 October. Umbra listed three Egyptian universities and an IT services firm between 7 and 10 October. Public legal summaries say the personal-data law's executive regulations, with a 72-hour notice to the regulator, enter full enforcement after 31 October 2026.

We rate the risk to Egyptian industrial and commercial groups, real estate and construction firms, and state-owned energy and transport companies as High, and for consumer-finance, hospitality, and healthcare firms as Elevated. For universities and public bodies we rate it High, driven by forum activity. These are our assessments of observed activity and likely impact, not measured probabilities, built on leak-site claims and forum posts that no one has verified.

1. Scope, and what the numbers can bear

This report covers claims naming organizations headquartered in Egypt that were published on leak sites between 1 January and 30 September 2026. Claims dated in October are cited separately as a later development. We combined two public trackers, ransomware.live and RansomLook, kept the first as the main source for dates, and attributed each claim by the victim’s headquarters and domain, not by the tracker’s country tag. We removed non-Egyptian companies with Egyptian offices, entries with masked or unverifiable names, and duplicates of the same victim within 14 days.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger.
• A group’s claim is not proof of compromise. We use “claim” for an unverified listing and “incident” only for an established event. We have not independently verified any claim, and two trackers sometimes date the same listing days or weeks apart.
• Each statement falls into one of three kinds: an observed listing (a claim that exists on a tracker), a finding corroborated by an outside source (named in the text), or our own assessment (marked as such). Country comparisons reflect our collection only, and we do not publish a claim-by-claim victim list because the claims are unverified.
• Forum and Telegram listings come from one commercial monitor that shows only a preview of each post. We describe them by category and name no victim. We name no actor’s nationality or sponsor unless public reporting does.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker (IAB): a seller of ready-made entry into a network. PDPC: Egypt’s Personal Data Protection Center.

2. Timeline: a spring peak and continued activity in Q3

The flow averages four claims a month. April is the busiest month with 8, followed by February and May with 6 each, and September with 5. The second-quarter peak comes from four groups at once: Payload and The Gentlemen in April, Lamashtu and NightSpire in May and June. The fall from 17 to 10 is a return to the pattern, not a recovery, because Krybit alone made six of the third quarter's 10. Dates differ between the two trackers by up to two weeks for five claims (a car dealer, a hotel, an engineering group, a chemicals producer, and a property developer), and none of those moves a claim across a quarter boundary.

The yearly bars are raw counts of the main tracker's Egypt tag, not the 36 cleaned claims. The 2026 bar holds 28 entries to 30 September and six in October, and it already exceeds all of 2025. Because earlier years were collected more thinly, we read the bars as a rising signal, not a measured growth rate.

3. The groups at a glance

Thirteen groups made 36 claims. The Gentlemen lead with eight (22%), Krybit made six, and Payload five. These three account for 19 claims, 53% of the total. NightSpire made four, LockBit 5.0 three, DragonForce and Lamashtu two each, and six groups made one claim each. Unlike the Maghreb, where one group's single-day batch drove the second quarter, Egypt's record is spread across many groups with repeat activity, which points to a market that affiliates return to.

Claims in the period 1 January to 30 September 2026. Read the Maghreb report · Read the Gulf report

4. Who is being hit

Our own classification of the 36 claims, using the trackers’ sector tags and correcting the ones we could see were wrong. Each claim is counted once.

Manufacturing and food lead at 22%, then real estate, construction, and engineering at 19%. Together with retail, distribution, and hospitality, the commercial economy makes up most of the list. Financial services draw 3 claims (8%), all against non-bank lenders and microfinance firms, and technology only one. That differs from Positive Technologies' 2025 picture, which counts all attack types and puts finance first at 19%, IT second at 14%, and the public sector and telecoms at 10% each. The two views do not contradict each other: data sale and intrusion cases lean to finance and IT, while ransomware leak sites lean to firms with operations to disrupt.

In Egypt the listed organization is usually a family-owned or listed group with plants, sites, and staff: the kind of business that cannot stay offline.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. The Gentlemen: eight Egyptian organizations in seven months

Claims. The Gentlemen listed eight Egyptian organizations between 13 February and 7 September. Two came on the same day, 13 February: a glass company and an airline. The rest are an engineering consultancy, an engineering and steel-construction group, a chemicals producer, a home-appliance group, a property developer, and a trading and retail holding that imports tyres and fashion brands. A Saudi engineering consultancy with Egyptian offices, listed on 31 August, is outside our count.
Reading. The cadence is about one claim every four to five weeks, with no long gap, which looks like a steady affiliate process aimed at established mid-sized and large groups with several sites. Such groups often have subsidiaries, shared IT, and suppliers that widen the effect of one intrusion. That is our inference, not a finding. We found no public statement from any of the eight.
Confidence. High that the listings exist. Moderate on the pattern. Low on what was taken.

Case 2. Krybit: six Egyptian claims the country filter hides

Claims. Krybit listed a national fuel distributor on 23 July, a frozen-food exporter on 26 August, three more on 1 September (a public construction holding, an animal-feed maker, and a private hospital), and the state airports company on 12 September. In the main tracker only the fuel distributor carries an Egypt tag. The others are tagged to the US, Saudi Arabia, India, Kenya, or nothing, while the second tracker describes each as Egyptian. On 4 October Krybit also listed an Egyptian fertility centre whose domain is the same as a Gunra claim recorded in April 2025.
Reading. Krybit posts in large batches that span many countries: on 1 September it listed 14 victims worldwide, three of them Egyptian. A tracker that tags by the batch's majority country, or by the victim's hosting location, will misplace some. For defenders the lesson is practical: match by name and domain, not by country tag. The repeated 2025 and 2026 listing of one healthcare brand shows that appearing once does not end the exposure.
Confidence. High that the listings exist and are Egyptian. Low on the data and on whether the October domain is the same entity as the 2025 one.

Case 3. Oil and gas: three companies, three groups, 15 weeks

Claims. Payload listed an Egyptian gas and condensate producer that operates in the Nile Delta and North Sinai on 8 April. APT73 listed a state-owned refiner in Alexandria on 27 April, the same date as its batch of four Moroccan institutions (see the Maghreb report). Krybit listed the national fuel distributor on 23 July. One tracker tags the gas producer to Libya; we count it as Egyptian and have corrected our Maghreb report to match.
Reading. Energy is a small slice of the list (8%), but it is the only sector where three separate groups appear within a few months, and two of the three are state-owned. State firms hold operational data about fields, depots, and supply contracts that interests more than extortion buyers. We hold no evidence about what was taken and found no public reaction from any of the three.
Confidence. High that the listings exist. Low on the data, the motive, and any link between them.

Case 4. NightSpire: consumer finance and hospitality, again

Claims. On 24 May NightSpire listed a consumer-finance company and the Egyptian franchise of an international pizza chain, on 26 May a microfinance company, and on 15 June a five-star resort hotel on the Red Sea coast. In 2025 the same group listed an Egyptian hospital (March), an investment firm (April), a microfinance association (June), and one more entry in November. Positive Technologies reports the microfinance association breach in May 2025, with 8 GB of data offered for sale; our second tracker dates the listing to 7 June.
Reading. That is eight Egyptian claims in two years, with finance and consumer brands as the repeating theme. Non-bank lenders and microfinance firms hold borrower identity and income data and often have lighter security budgets than banks. This is our reading; the claimed volumes are mostly not stated.
Confidence. High that the listings exist. Moderate on the sector pattern. Low on volumes and on the 2025 dates.

6. Active threat actors: presence, motivation, and TTPs

Three selected actors, chosen for relevance to defenders and not by volume alone, made 19 of the 36 claims and are profiled below. Their public technical detail comes from global incident reporting, not from the Egyptian cases, so read the tradecraft as known behavior of each group in general, not proof of what happened to a named firm. Technique IDs refer to MITRE ATT&CK.

Five actors with sufficient public technical reporting are shown, each with at least two Egyptian claims. Krybit has no column because public technical reporting on it is thin. Marks reflect public reporting on each group worldwide, not Egyptian incident evidence. An empty cell means the technique is not documented in the sources we reviewed, not that the group does not use it.

Actor profiles

Other groups worth knowing

• NightSpire (4), LockBit 5.0 (3), DragonForce (2), Lamashtu (2). See sections 3 and 5. LockBit 5.0 listed an agriculture ministry on 23 February, a car dealer in April, and a hotel in the north-coast resort of El Alamein in May. DragonForce listed a pharmaceutical firm on 4 April and a casino in Sharm El Sheikh on 16 July. Lamashtu listed a pharma and cosmetics group on 4 May and a food maker on 17 June.
• Tengu, The Green Blood Group, Crypto24, Pear, APT73, and Orova (1 each). A travel agency on 27 January (Tengu), a building-materials maker in the Suez Canal zone on 4 February (The Green Blood Group), an engineering firm on 5 March (Crypto24), an IT services firm on 6 March (Pear), a state-owned oil refiner on 27 April (APT73), and a Cairo healthcare firm on 4 August (Orova). The Green Blood Group, Orova, and Pear are newer brands with little public reporting.
• Earlier groups in the 2025 record. Positive Technologies cites BlackShrantac, which claimed 6 TB from a leasing subsidiary of the National Bank of Egypt; DragonForce, which listed a national IT provider and software developer in December 2025; FunkSec, which claimed data from a maritime logistics body; and Gunra, which listed a medical provider.

7. Beyond the leak sites: the forum and Telegram market

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums and Telegram: data sellers, access brokers, hacktivists, and attention seekers. One commercial monitor lists 73 posts tagged to Egypt. Its preview shows 12 of them, dated 15 September to 16 October, so what follows is a sample and not a count.

• Education and finance lead the visible sample. Four of the 12 name universities or faculties, two name the non-bank financial regulator (once on a forum on 28 September and once on Telegram the next day, from two handles), two name technology firms or events, and one names a property company. Three more are unclassified: a company domain, a marketplace brand, and a title citing 60 million Egyptians.
• A few handles repeat. The monitor's five most active handles in this view account for 20 of the 73 posts (27%): INT3X and CrowStealer 5 each, Revesky 4, and BIGBROTHER and Keymous 3 each. BIGBROTHER and Keymous also appear in our Maghreb data, so the same names work across North Africa.
• Several forums, one market. The monitor lists sources at pwnforums (11 posts), breachforums (8), and three darkforums domains (8, 7, and 6). Reposting across forums is common, so 73 posts is not 73 breaches.
• Consistent with the wider picture. Positive Technologies found that 39% of the dark-web listings it reviewed for Egypt in 2025 were sales and 31% free distribution, that databases were 59% of sales and network access 29%, and that retail (14%) and science and education (12%) were the most-listed sectors. Our education-heavy sample points the same way.

As elsewhere, data published by attackers may come from older leaks or several sources, and victims should qualify it before acting. Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low.

8. Update outside the report window: October 2026

Between 4 and 15 October the trackers list six more Egyptian claims. Umbra, a group first tracked on 6 October, listed a technological university in Beni Suef on 6 or 7 October (claimed 900 GB), an IT services and software firm in Cairo on 7 October (6 TB), the arts, music, and media faculty of a Cairo public university on 8 October (163 GB), and a Helwan technological university on 10 October (481 GB). Krybit listed the fertility centre on 4 October (Case 2), and a group called N0n listed a computer training academy on 15 October. We left out two further entries: a LockBit 5.0 listing on 15 October for a .com.eg domain, and a NightSpire listing on 8 October for a domain we could not tie to an Egyptian company. These claimed volumes are the groups’ own and unverified, and we hold no confirmation from the universities or the firm that data was taken. Umbra’s four listings in a week make education the leading October theme to watch.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public vendor reporting, on Positive Technologies' 2025 study, and on how the forum listings are titled.

• Malware and phishing. Positive Technologies reports that malware (45%) and social engineering (26%) were the main vectors in successful attacks on Egyptian organizations in 2025, with ransomware (33%) and spyware (25%) the main malware types. It names MuddyWater and UpCrypter phishing campaigns that hit IT and industrial firms.
• Valid accounts and exposed remote services. Vendors describe The Gentlemen and DragonForce affiliates working through VPN and remote-access accounts, often with credentials bought or stolen earlier, before disabling security tools. The mid-sized groups on our list are the typical target for this route.
• Bought access. Positive Technologies found that access to corporate networks made up 29% of Egyptian dark-web sales listings, including a telecom provider's internal network offered for $12,000. A ransomware affiliate can buy such access and skip the break-in.
• Supply chain and group structure. The same study says Egypt is highly exposed to supply-chain attacks, and notes attackers moving from well-defended banks to subsidiaries and contractors. Our list fits: leasing, consumer-finance, and microfinance firms, a trading holding, and a state airports company each sit inside a larger group or public network.

10. The regulatory frame

We rely on public legal summaries, not on the official texts. Egypt’s Personal Data Protection Law No. 151 of 2020 sets duties for controllers and processors. Its executive regulations, Ministerial Decision No. 816 of 2025, were issued on 1 November 2025. Summaries say they require notice to the Personal Data Protection Center within 72 hours of becoming aware of a breach, with a description of the breach, the estimated records affected, and the measures taken, and notice to the people concerned within three days of notifying the Center. They also create licensing and data-protection-officer requirements. Law summaries report a one-year grace period that ends on 31 October 2026, after which the Center is expected to enforce fully; check the current position with counsel. The end of a grace period is not a new notification duty: the 72-hour and three-day rules come from the regulations themselves, and which organizations they cover should be confirmed with counsel. Law No. 175 of 2018 on information-technology crimes, the Telecommunication Regulation Law No. 10 of 2003 under which the NTRA and EG-CERT operate, and the 2022 fintech law add sector duties. Positive Technologies notes Egypt reached the top tier of the ITU Global Cybersecurity Index in 2024, and the national cybersecurity strategy covers 2023–2027. Egypt is also reported to follow a policy of not paying ransoms as a member of the Counter Ransomware Initiative.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the data above.

1. The leak-site flow stays at 8 to 18 claims a quarter. The record has run 9, 17, and 10, and six claims appeared in the first 15 days of October. We expect Q4 to land at or above Q3.
2. Education is a sector to watch. Four university or faculty items in a 12-post forum sample and Umbra's four October listings are a reason to look at university exposure, not proof of a sustained campaign. Student records, research data, and staff accounts make them valuable.
3. The Gentlemen and Krybit continue. The Gentlemen have named a new Egyptian group about every five weeks. Krybit posts in batches and may add more state-linked names. Both are likely to show up under wrong country tags.
4. State-owned energy and transport stay exposed. Three oil and gas names, an airports company, and an agriculture ministry were listed in 2026. Operators of fields, depots, and airports hold data and systems whose disruption has public consequences.
5. Data-protection enforcement raises the cost of a claim. From 1 November a listing that names personal data can start a 72-hour clock. Expect board-level questions about who decides, who notifies, and who speaks publicly.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, remote-access gateway, and webmail, patch exposed systems, require multi-factor authentication, and review who can reach admin interfaces.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse.
3. Map your group, not just one company. Many listed Egyptian firms sit inside a group with shared IT, a shared domain, and shared suppliers. Segment subsidiaries, limit trust between them, and test restoring one company without reconnecting the others.
4. Universities and public bodies: audit before a forum does it for you. Test every public web application, remove default and test panels, review staff and student accounts, and keep offline backups of student and research data.
5. Verify claimed data before you act. If your name appears with a record count, check where the data could come from, how old it is, and whether it matches your records, then decide on notification with your data-protection lead and counsel. Do not open leaked files on a normal workstation.
6. Rehearse the 72-hour clock before 1 November. Decide who confirms a breach, who drafts the notice to the Center, who informs individuals within three days of it, and who briefs the board. Run one tabletop exercise built on a leak-site listing.
7. Monitor by name and domain, not by country tag. Watch leak sites, Telegram channels, and broker forums for your company, subsidiaries, brands, and suppliers, in English and Arabic spellings, so a mis-tagged listing does not slip past.

Sources

• Ransomware.live, country victim records
• RansomLook, group and post records
• Positive Technologies, Shadows of the pyramids: Egypt's cyberthreat landscape in 2025
• Al Tamimi & Co., Egypt issues executive regulations of the Personal Data Protection Law
• Digital Policy Alert, Decision No. 816 of 2025 entered into force
• Wikipedia, Nile Air (headquarters and ownership)
• ClairSec_, Maghreb ransomware report

The vendor forum feed we sampled is a commercial service and is not linked.