Ransomware and Data-Theft Claims in Qatar: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in Qatar.

1. Qatar has the second-fewest observed claims of the six Gulf markets we track, and the data show no clear rise. Five observed claims against 17 in Saudi Arabia, 45 in the UAE, seven in Oman, six in Kuwait, and three in Bahrain, though visibility differs by country and by year, so a series this small supports little more than that. By our count there were 5 in 2023, 2 in 2024, and 4 in 2025, so 2026 sits inside its own range.
2. The activity was concentrated in a short window. Four of the five claims landed between 17 April and 12 May, none in Q1, and one in Q3. Two of them were posted by The Gentlemen on 12 May: a government-owned fiber network operator and a design and engineering firm with stadium and circuit credits.
3. Qilin is Qatar's recurring group, and it does not appear in our Saudi or UAE data. It posted a Qatari holding company and a school in October 2025, a construction firm in August 2026, and a grocery importer on 7 October. No other group has a pattern here.
4. Forums are a parallel market worth watching. We reviewed 12 forum posts over eleven weeks. One handle listed four of Qatar's major banks on a single day, 13 June, and others offered a pension authority, a hospital, and a pharmacy chain. These claims are unverified, and none of them appears in the leak-site record we reviewed.
5. Gulf-wide groups pass through. The Gentlemen work Saudi Arabia, the UAE, Oman, and Qatar. Payload claimed Bahrain, the UAE, and Qatar within 36 days. One forum handle, Anonymous2090, posts in the Kingdom, the UAE, and Qatar. Defend against the groups' behavior, not just the local headline.

We rate the risk to Qatari professional-services firms, contractors, and engineering suppliers as Medium and steady. For banks and national infrastructure operators we rate it Elevated, driven by forum access listings and the physical war context. Our data does not show war-related cyber claims against Qatari organizations.

1. Scope, and what the numbers can bear

This report covers claims naming Qatari organizations that were published between 1 January and 30 September 2026. A claim dated 7 October (Qatar National Import & Export) is cited separately as a later development and is not in the five or the quarterly figures. All five are financially motivated extortion claims. A company listed twice for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile. Visibility differs by country, so the counts are not complete incident totals and are not a like-for-like measure of national risk.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger. With counts this small, a single incident changes the picture.
• A group’s claim is not proof of compromise. We have not independently verified any published dataset.
• Attributing a victim to a country is imperfect, and some firms operate across the region. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker: a seller of ready-made entry into a network.

2. Timeline: a quiet record with one burst

The pattern is a single burst. Nothing appeared in Q1, even as the war began. Four claims then landed between 17 April and 12 May, from three different groups, and one more arrived in late August. One reading is a few affiliates working Qatari targets from access they already held, but the dates alone cannot tell us where the access came from.

The war context is physical first. Qatar's foreign ministry says it has been hit by Iranian missile and drone attacks since 28 February, including Ras Laffan, Mesaieed, and Hamad International Airport, and calls the Ras Laffan strike a direct threat to national security. Our leak-site data holds no claim by a war-aligned persona against a Qatari organization in the window, which differs from the UAE and the Kingdom, where such claims appeared in March. Earlier, a CYFIRMA assessment recorded a pro-Palestine group, Team Fearless, launching DDoS attacks on several Qatari government websites on 10 September. The war is relevant to risk, but it is not evidence that cyberattacks on Qatari organizations have increased, and our data does not show such an increase.

3. The groups at a glance

Four groups made five claims, so no group has more than two. Only The Gentlemen appears in the Saudi, UAE, and Qatar data. Payload appears in the Qatar and UAE data but not in the Saudi data we reviewed. Crypto24 is Qatar-only in our Gulf data, and Qilin also appears in Kuwait. Cyble also names Everest among 2026 Qatar actors, but we have no Everest claim against a Qatari organization.

4. Who is being hit

Our own classification of the five claims. Each claim is counted once.

• Professional services: 2. Al Sulaiti Law Firm and Focus Design Partners.
• Telecom infrastructure: 1. Qatar National Broadband Network, a government-owned fiber operator.
• Research and healthcare: 1. Qatar Biomedical Research Institute.
• Construction and engineering: 1. Black Cat Engineering & Construction.

The pattern differs from the Kingdom and the UAE. There are no family groups, no consumer brands, and no manufacturers. Four of the five victims are professional, engineering, or operating firms whose work may touch national projects or critical sectors, judging from their public profiles and announced projects, which does not establish a direct link between all of them and the government or the energy sector: a law firm with banking and energy clients, a design firm credited with national stadium and circuit projects, a contractor, and a state-owned network. In a small market where much of the economy depends on the state, the same few clients can stand behind many suppliers.

In a small market, the supplier list is short, and the same names sit behind it.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. 12 May: a state network and its designers (The Gentlemen)

Claim. On 12 May The Gentlemen listed Qatar National Broadband Network, a government-owned fiber operator established in 2011 that provides passive infrastructure to all licensed providers, and Focus Design Partners, a design and engineering firm with about 50 years of work and credits that include a national stadium and a motor-racing circuit. The group's own text for the design firm says the full leak will be posted unless the company contacts it to negotiate. The listings carry no data volume that we could see.
Reading. Two organizations that sit on opposite ends of the same national program were listed on the same day. Same-day listings are consistent with several possibilities: a single affiliate, a batch of previously obtained access, or unrelated listings published together. The evidence does not establish a shared intrusion, supplier, or vector, and it does not show a link between the two victims. If the claim about the network operator is accurate, the exposure would matter beyond one company, because its customers are the licensed telecom providers, which in turn serve homes, businesses, and government.
Confidence. Moderate that the listings were posted as described. Low on the contents and any common vector.

Case 2. Qilin’s Qatar run (October 2025 to October 2026)

Claims. Artan Holding, a Qatari family-owned holding with education, real-estate, and industrial businesses (10 Oct 2025). Doha British School, a three-campus school group (24 Oct 2025). Black Cat Engineering & Construction (23 Aug 2026, listed again on 30 Aug). Qatar National Import & Export, a grocery retailer (7 Oct 2026).
Reading. Qilin is the global leader with 338 victims in Q1 2026, yet it has no claim in our Saudi or UAE data. In our Qatar record it appears against four distinct victims since October 2025: a family holding, a school, a contractor, and a grocery business. Only the Black Cat claim falls inside this report’s January to September window; the other three sit before it or after it. The re-listing of Black Cat one week later is typical of an update after a deadline passes, and we count it once. The spread of sectors and the long gaps suggest affiliates working opportunistically from bought access, not a campaign against one industry.
Confidence. High on the counts and dates. Low on why Qilin appears here and in Kuwait but not in the Saudi or UAE data.

Case 3. A research institute (Crypto24, April)

Claim. On 17 April Crypto24 listed Qatar Biomedical Research Institute, which operates under Hamad Bin Khalifa University. We saw no data volume or description.
Reading. Research bodies hold unpublished results, genomic and patient-linked data, and grant material. Crypto24 is known for tooling that switches off endpoint security from many vendors, which matters for institutions that run mixed, university-style IT estates with many administrators. A single claim is not a pattern, and this group's main footprint lies in the United States, Europe, and Asia.
Confidence. Moderate on the claim, low on what was taken.

Case 4. Payload crosses three Gulf states in 36 days

Claims. 15 March: Royal Bahrain Hospital, with 110 GB claimed and a deadline of 23 March. 28 March: A A Al Moosa Enterprises (ARENCO), a Dubai conglomerate. 20 April: Al Sulaiti Law Firm in Doha.
Reading. Payload has existed since mid-February and was already working across the Gulf six weeks later, in healthcare, a conglomerate, and legal services. That is quick geographic spread for a new brand, consistent with affiliates reusing the same access sources across several countries. A law firm is an attractive target in any market: it holds client agreements, disputes, and deal documents for firms far larger than itself.
Confidence. High on the dates. Moderate on the shared access explanation, which is our inference.

Case 5. Four banks on one forum listing (13 June)

Claim. On 13 June a single forum handle, cabyc, posted four listings on the same day, each naming the domain of one of Qatar's major banks. We have not seen the content of the listings.
Reading. Four banks in one day from one handle does not read as four separate breaches. It reads as an access, credential, or database sale that touches several banks, possibly through a shared vendor or a shared type of exposure. It could also be a seller padding a listing with well-known names. The same handle posted five Kuwaiti listings the same day, which points to a regional seller, not a Qatar-specific exposure. Banks should treat it as a verification task, not a confirmed incident: check for exposed credentials and sessions, shared third parties, and any contact from the seller.
Confidence. High that the listings exist. Low that they describe real breaches. We do not name the banks beyond the fact that they are major Qatari institutions.

Case 6. Qatari exposure through a foreign supplier (April)

Claim. On 29 April a group called Aurora listed a luxury resort in the Maldives, claiming about 75,000 passport scans across ten years, with nine passports it attributes to members of the Qatari royal family among them, plus guest profiles, staff records, credentials, and a management contract. We name no individuals.
Reading. The claim is not about a Qatari organization, which is why it is outside our count. It shows a different route of exposure for Qatari people and institutions: identity documents and travel details held by hospitality and travel suppliers abroad. If accurate, no Qatari control could have prevented it.
Confidence. Low to moderate. A single claim by the actor.

6. Active threat actors: presence, motivation, and TTPs

Four actors made all five claims. Their public technical detail comes from global incident reporting, not from the Qatari cases. We have no incident-level evidence from Qatari victims, so read the tradecraft below as known behavior of each group in general, not proof of what happened to a named Qatari firm. Technique IDs refer to MITRE ATT&CK.

Summary: motive and presence

What the actors share

Group names differ, but their methods overlap. In publicly documented worldwide activity, all four groups show methods that include disabling security tools before encryption and stealing data to publish. That does not show these methods were used in the Qatari claims in this report.

Marks reflect public reporting on each group worldwide, not Qatari incident evidence.

Actor profiles

Earlier groups in the Qatari record

• LockBit 3.0. Posted several Qatari firms between 2021 and 2023, including a maintenance services company, a building group, and an energy-services provider. A CYFIRMA assessment says LockBit, including its version 5, keeps targeting Qatari organizations.
• Dispossessor. Claimed a Qatar branch of a US university in July 2024 with a video and an explicit reference to Qatar's 2016 data privacy law as leverage.
• Babuk-style listings. In March 2025 two posts offered corporate access to a Qatari fuel company and to shipping applications.
• RansomExx, Rhysida, Sarcoma. One Qatari claim each between 2023 and 2024: a general contractor, a state-linked racing and equestrian club, and an electronics retailer with about 800 staff.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. We reviewed 12 Qatar-targeted forum posts published between 13 June and 27 August 2026. That is a short sample, so we read it as a snapshot of the market, not a trend. We name no victims here, because the claims are unverified and naming a target may amplify an unproven claim.

What the 12 posts target

• Finance and social insurance: 5. The four-bank listing of 13 June and a post offering a government retirement and social insurance authority.
• Healthcare: 2. A private hospital and a regional pharmacy chain.
• Government and security: 2. A post titled for the security of the Qatari state, and an internet-services company listed under government.
• Consumer, humanitarian, and other: 3. A shopping platform with 36,000 records, a national humanitarian society, and one unclassified listing.

Who is posting

Nine handles made 12 posts, and one, cabyc, made four (a third). The other eight posted once each. The sample shows limited concentration, with one handle contributing a third of the posts. Anonymous2090 is the one handle that also appears in our Saudi and UAE samples, which makes it a regional seller worth tracking across borders.

A CYFIRMA assessment adds three data points from Russian-language and Chinese-language forums: an initial access broker offering corporate access to a large Qatari organization for USD 4,900, SSH access to the servers of a Qatari company, and a seller of 100,000 Qatar-themed credential pairs. Cyble finds that banking, financial services, insurance, and retail account for more than half of Qatar-linked access listings, and that education has the most frequent leak incidents. The access prices are low relative to the size of the targets.

Why this matters for ransomware risk

Access sold cheaply is the front end of the ransomware chain. A leak-site record of five claims says little about how much access is on sale, and forum evidence suggests the supply is wider than the leak-site record. We cannot link any listing to any claim, and we do not. The reason to watch forums is the interval between a sale and a public claim, which is usually days to weeks.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. For claims about government and security bodies, verify before you escalate. Check whether the data is old or public, whether it matches your records, and whether the poster offers sample files.

8. Update outside the report window: October 2026

On 7 October Qilin listed Qatar National Import & Export, a grocery retailer, with no description. It is Qilin’s fourth Qatari claim in twelve months, and it is outside this report’s window and not in the five.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public regional reporting. The consistent picture:

• Exploited remote-access products. Cyble notes a surge in exploitation of Microsoft, Fortinet, Ivanti, and Citrix remote-access tools affecting Qatar.
• Bought access and stolen credentials. Access brokers sell entry cheaply, and combolists feed credential stuffing, account takeover, and business email compromise.
• Security tool disabling. Crypto24 and Payload both switch off protection before encrypting, so endpoint tooling alone is not a last line.
• Supplier trust. The Gentlemen's same-day pair and the four-bank listing could both reflect shared third parties, which is one hypothesis worth investigating among several.

10. The regulatory frame

Qatar’s Personal Data Privacy Protection Law (Law No. 13 of 2016, the PDPPL) is the governing statute. We checked the points below against the Arabic text and the English translation published on Al Meezan, the Qatar legal portal, which itself notes that the displayed text is not official, and against the National Cyber Security Agency (NCSA) Personal Data Breach Notification Guidelines for Regulated Entities (version 2.0, September 2022). The statute assigns breach reports to the “Competent Department”, a unit of the Ministry; the guideline presents the NCSA’s National Cyber Governance and Assurance Affairs department as the body handling them. Three things need to be kept apart.

• The statutory obligation. Article 13 requires controllers and processors to take precautions against loss, damage, change, disclosure, access and inadvertent or illegal use, commensurate with the nature and importance of the data, and requires a processor to notify the controller "forthwith" of any breach of those precautions or any risk to the data. Article 14 requires the controller to inform both the individual and the Competent Department of a breach of the precautions if it may cause serious damage to the data or to the individual's privacy. The statute sets no number of hours or days.
• The guideline's deadline. The 72-hour window, running from becoming aware of the breach, comes from the NCSA guideline, not from the statute. It is regulator guidance on how to meet Article 14, and it should be read as the regulator's expectation, not as statutory text.
• The penalties, separately. Article 23 sets a fine of up to QAR 1,000,000 for violating a list of provisions that includes Article 14 (failing to report) and Article 8 (the controller's own protective measures). Article 24 sets a fine of up to QAR 5,000,000 for violating Article 13 (the precautions, and the processor's duty to notify the controller), the third paragraph of Article 16, or Article 17. Article 25 adds a fine of up to QAR 1,000,000 on a legal person when an offense is committed in its name or for its benefit, without prejudice to the liability of the individual involved. The text says "shall not exceed"; it does not say "per violation".

Firms in the Qatar Financial Centre and regulated financial institutions answer to their own regimes in addition, and we have not reviewed those. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. Leak-site volume stays low, with bursts. One claim was recorded in the first week of October. We expect two to five claims in the quarter, a low-confidence range resting on a very small record that group activity and leak-site coverage could change.
2. Qilin remains the most likely repeat name. It has the longest and steadiest Qatari record, so expect more claims against mid-sized firms and schools.
3. Advisers to the state stay in view. Law, engineering, design, and consulting firms hold the same client files as larger targets, with smaller defenses.
4. Forum listings will surface as claims. Some forum-listed Qatari access will reappear as leak-site victims within weeks, and bank-related listings deserve verification now.
5. The war stream is a wildcard. Energy and aviation facilities were physical targets. A cyber dimension has not appeared in our leak-site data, but it can appear quickly.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway from Microsoft, Fortinet, Ivanti, and Citrix. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse. Banks should do this first, given Case 5.
3. Rank your advisers and suppliers by what they hold. Law firms, engineering and design consultancies, contractors, and network operators in your supply chain hold your contracts and designs. Ask each for MFA, EDR, and offline-backup evidence.
4. Assume endpoint security can be switched off. Alert on service stops, kernel-driver loads, and unusual svchost behavior, and keep a second line of detection on the network.
5. Protect the hypervisor layer. Payload targets VMware ESXi. Isolate management networks and keep offline, tested backups.
6. Rehearse the double-extortion call. Know who notifies the NCSA, who briefs the board, who talks to your regulator, and who decides on negotiation. Write it down and test it.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• Cyble, Qatar's digital boom has a blind spot
• CYFIRMA, Qatar threat landscape assessment
• HookPhish, The Gentlemen hits Qatar National Broadband
• DeXpose, TheGentlemen targets Focus Design Partners
• Qatar Ministry of Foreign Affairs, Iranian attacks statement, 11 March 2026
• Newsquawk, Qatar says Iranian Ras Laffan attack is a direct threat to its national security
• Check Point Research, The State of Ransomware Q1 2026
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• Proven Data, Qilin attack chain and MITRE ATT&CK TTPs
• Hive Pro, Crypto24 ransomware and its custom EDR bypass
• Proven Data, Payload ransomware variant analysis
• UpGuard, Payload claims data breach on Royal Bahrain Hospital
• NCSA, Personal Data Breach Notification Guidelines for Regulated Entities, version 2.0 (September 2022)
• Al Meezan, Qatar Law No. 13 of 2016 on Protecting Personal Data Privacy (Arabic text, 3 November 2016)
• Al Meezan, Law No. 13 of 2016, English translation (PDF)

Sources are linked in their original language.