Ransomware and Data-Theft Claims in Saudi Arabia: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in the Kingdom.

1. Volume more than doubled, and Q3 was the peak. Claims ran 4, 4, then 9 by quarter. Nine claims in Q3 is more than the first half combined, and four of them came from one group in 31 days.
2. The market has no center. Ten groups produced seventeen claims, and seven of those groups appear once. The Gentlemen are the most active group and carry 35% of the total; no other group has more than two claims. Blocking one operator's indicators protects against a minority of the field.
3. Energy and its associated supply chain are the main focus. Six of seventeen claims touch it: a drilling-services firm, an oilfield-chemicals group, a refinery contractor, an engineering consultancy serving Aramco and SABIC, a power developer, and Aramco itself. Four different groups made those claims.
4. Different actors want different things. Affiliates want money, one state-aligned persona wants damage, and a few brands want attention. Each leaves different traces and demands a different response. Section 6 profiles them.
5. Forums are the early-warning layer. In the seven weeks to 9 October we reviewed 36 Saudi-targeted forum claims, including two network-access listings. Government and security bodies, logistics platforms, and mid-market firms dominate. Section 7 covers them.

We rate the risk to Saudi mid-market firms, contractors, and energy suppliers as High and rising. For national-scale operators we rate it Elevated, driven less by criminals than by the geopolitical stream described below.

1. Scope, and what the numbers can bear

This report covers claims naming Saudi organizations that were published between 1 January and 30 September 2026. The 17 include one claim, against Aramco, that is a hacktivist destructive-attack claim rather than financial extortion. We keep it in the counts and treat it separately. Claims dated October are cited separately as later developments and are not in the 17 or the quarterly figures. Of the 17, 16 are financially motivated extortion claims and one is a destructive-attack claim. Counts are observed leak-site claims: publicly posted claims that name an organization, collected up to 10 October 2026. A company listed more than once for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, and we leave out entries whose main operations are elsewhere. Visibility differs by country, so the counts are not complete incident totals and are not a like-for-like measure of national risk.

Three caveats apply to everything below.

• Leak sites show only victims who did not pay or negotiate privately. Real incident counts may be higher, and nobody publishes by how much.
• A group’s claim is not proof of compromise. We have not verified any dataset.
• Attributing a victim to a country is imperfect. Some Saudi victims will be missed. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Infostealer: malware that steals saved credentials and sessions from infected devices. White-label: a model in which affiliates run attacks under their own brand using the platform.

2. Timeline: two streams, not one

The quarterly curve hides two different problems.

Stream one is geopolitical. Iranian strikes on Saudi territory began on 28 February 2026, including drone attacks on Ras Tanura on 2 March. On 3 March the Iran-linked persona Handala posted a claim against Aramco, one day after claiming Sharjah National Oil Corporation in the UAE. Public reporting links Handala to Iran's Ministry of Intelligence and Security and describes its tooling as wipers, not encryptors. This is not ransomware economics: there is no ransom note, and no one is selling anything back. Positive Technologies found that Q1 produced 96% of all Gulf cyber incidents in its H1 2026 dataset, with Saudi Arabia taking 15% of regional attacks. The war pulled the Kingdom into a state-aligned campaign at the moment criminals were growing.

Stream two is criminal and keeps growing. It does not follow the war. The Q2 and Q3 claims have nothing to do with the front line. We attribute them to financially motivated criminal activity that typically relies on exposed access services and weak credentials. That is our interpretation, not a confirmed intrusion path in each case. CloudSEK counted regional Middle East ransomware activity rising from 17 incidents in April 2025 to 357 in June 2026, and its researcher put it bluntly: Gulf states were not a primary target until 2025, and that changed fast.

Planning for one stream and ignoring the other leaves a gap. A wiper claim and a data-theft claim call for different decisions, different recovery plans, and different people in the room.

3. The groups at a glance

The Gentlemen are the most active group in the Kingdom. Six claims is 35% of the total, and no other group has more than two. Globally the group posted 166 victims in Q1 2026 per Check Point, about 8% of 2,122, so it over-indexes here by a factor of four.

Qilin is absent. It led the world for three straight quarters with 338 victims in Q1, yet has no 2026 claim in our Saudi data. Either its affiliates are not working the region, victims are paying, or claims are filed under other countries. We cannot tell which, and we do not read it as safety.

The tail is the story. DragonForce, Tengu, Krybit, BlackNevas, Gammax, Panzer, and Handala each claimed one Saudi victim. Several are new or low-reputation brands. Low barriers to entry, rented tooling, and cheap affiliate access let a new name appear, post twice, and vanish before a detection rule is written. Defense built around group names does not scale against this.

4. Who is being hit

Our own classification of the 17 claims. Each claim is counted once.

• Energy and associated supply chain: 6. Sawafi, ACWA Power, Aramco, Al-Saidi, Almeer, SAUDCONSULT. We include operators plus the suppliers, contractors, and consultants whose main work serves oil, gas, or power clients. This is a supply-chain framing, not a count of six energy operators.
• Diversified family and holding groups: 4. Babgi (over USD 7.4 billion in revenue, per a commercial company profile), Arabian Procession Holding, AWJ Holding, MTCO.
• Industrial manufacturing: 2. ALUPCO and Al-Gosaibi GTB.
• Engineering consultancy outside energy: 1. Khaled Alfagih Engineering Consultancy, which designs healthcare facilities.
• Non-profit: 2. SEHA and Al Rawdah Cooperative.
• Retail and other: 2. L'azurde, a Tadawul-listed jeweler, and Efada.

Three patterns stand out. Energy dominates: 35% of claims sit in or beside the oil, gas, and power chain. Family groups are a new target class: four diversified groups across automotive, aviation retail, real estate, and trading, each holding data on many subsidiaries and partners. And no bank, insurer, or telecom operator appears. We do not know why. Possible explanations include stronger controls, the groups' own interests, or simply what we can see.

CYFIRMA's November 2025 to January 2026 window shows the same shape from another angle: real estate and construction first, then healthcare and IT services, including a construction firm hit in late December with 4.15 TB claimed and a USD 400,000 demand.

The Kingdom’s biggest programs are only as secure as their smallest consultant.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. ACWA Power and Larsen & Toubro (INC Ransom, February)

Claim. INC Ransom posted a joint listing naming ACWA Power and its partner Larsen & Toubro, with 400 GB. Public reporting says the data sits in a shared project repository for the Al Muwayh solar PV project, and includes engineering plans, ISO quality certificates, Ministry of Energy documents, safety manuals, and contractor agreements. Public reporting says the listing carried a USD 100 million revenue tag. The actor's own date is 15 February, and the claim reached public tracking on 24 February, a nine-day gap.
Reading. The target is not either company's core network. It is a shared space where two firms and their contractors exchange files, so one weak account at a partner could expose both. Ministry documents in the set raise the stakes from commercial to government. If the revenue tag is the group's own, it would be consistent with sizing the demand to the victim.
Confidence. Moderate. The claim and its contents are the actor's. We have no confirmation from either company.

Case 2. Energy and its associated supply chain (four groups, six claims)

Claims. Sawafi, a drilling-and-completions services firm (Gentlemen, 21 Feb). ACWA Power (INC, 24 Feb). Aramco (Handala, 3 Mar). Al-Saidi, oilfield chemicals and logistics (DragonForce, 12 Jul). Almeer, a contractor to refineries and fertilizer plants (Gentlemen, 21 Aug). SAUDCONSULT, a consultancy that a commercial profile puts at 2,800 staff, with clients that include Aramco, SABIC, SADARA, and MAADEN (Gentlemen, 31 Aug).
Reading. Three criminal groups and one state-aligned persona hit different tiers of the same chain, and the criminals went after suppliers, not operators. Operators have the budget and the controls. Their drilling contractors, chemical suppliers, builders, and consultants hold their designs, schedules, and site details with less protection. Because the groups did not coordinate, the pattern reflects a structural weakness, not one actor's campaign.
Confidence. High on the pattern of victims. Low on any shared cause.

Case 3. Aramco and Sharjah National Oil, back to back (Handala, March)

Claim. On 2 March, Handala claimed Sharjah National Oil Corporation in the UAE, with 1.3 TB of financial data, oil contracts, and project details. On 3 March it claimed Aramco, in language framed as political retaliation, with no data volume given. The Ras Tanura drone strike was on 2 March.
Reading. Two energy majors in two countries on consecutive days is a message, not an extortion campaign. The persona is announcing reach. Its public record includes inflated figures: in April it claimed to have wiped 6 PB from government systems in an unnamed GCC financial hub. We saw no evidence of operational disruption at Aramco. Treat the claim as influence activity with a possible hack-and-leak behind it, and prepare for destruction anyway, because the group's tooling is destructive.
Confidence. Moderate on attribution to the persona, low on any impact.

Case 4. The Gentlemen accelerate (six claims, February to August)

Claims. Sawafi (21 Feb), Arabian Procession Holding (4 Jun), Babgi (31 Jul), Almeer and AWJ Holding (both 21 Aug), SAUDCONSULT (31 Aug). The gaps between posts shrink: 103 days, then 57, then 21, then zero, then 10. Four of the six fell inside 31 days.
Reading. The shrinking gaps are consistent with a growing stock of access. Same-day pairs (Almeer and AWJ on 21 August) are consistent with one affiliate, a batch of previously obtained access, or unrelated listings published together. The evidence does not tell us which. In the UAE the same group ran the other way: four claims in Q1, one in Q2, and two in Q3. That is consistent with affiliate attention shifting toward the Kingdom through the summer, though the UAE has not gone quiet (its latest claim in our UAE data is 9 August) and the numbers are small.
Confidence. High on the cadence. Moderate on the rotation reading.

Case 5. 27 April: one day, four Gulf victims (APT73)

Claims. Al-Gosaibi GTB and Al Rawdah Cooperative in the Kingdom, and in the UAE a federal ministry (Climate Change and Environment) and the Sharjah electricity, water, and gas authority. Four posts, one group, one day.
Reading. A same-day, cross-border batch is consistent with one intrusion set or one affiliate posting together, though unrelated listings are also possible. The mix of a ministry, a utility, an industrial firm, and a cooperative has no sector logic. One hypothesis is a shared vector: a vulnerable product, a shared IT supplier, or reused credentials. The evidence does not establish it. Anyone with exposure to a shared vendor should ask that supplier directly.
Confidence. Moderate on the batch reading, low on the vector, which is our hypothesis.

Case 6. From leak site to forum: Efada (Krybit, September)

Timeline. 24 Sep: Krybit posts efada.sa on its leak site. 25 and 26 Sep: a forum seller posts a Saudi company at efadah.com.sa twice. 8 Oct: a second handle posts the same domain again.
Reading. The domains differ by one letter and one suffix, so we do not claim they are one victim. If they are, the sequence shows the secondary market in action: after the primary extortion post, the same data is resold or re-advertised by others within a day, and again two weeks later. Each repost widens the number of people holding the data and shrinks the value of paying the original extortionist.
Confidence. Low to moderate on the link. High that reposting is common.

Case 7. L’azurde and the listed issuer (BlackNevas, July and September)

Claim. BlackNevas listed L'azurde, a Riyadh jeweler trading on Tadawul under 4011, on 14 July, and a second listing dated 9 September names it again beside an Omani conglomerate. The group sells stolen data directly and has, in its UAE listings, offered corporate-network access and an IT insider pressed into cooperation.
Reading. A listed company carries disclosure duties that a private firm does not, and an offer to sell access moves the incident from data exposure to ongoing compromise. A listed target also gives the seller reputational leverage on its share price. Boards of listed Saudi firms should treat any BlackNevas contact as a disclosure-relevant event and brief legal counsel at once.
Confidence. Moderate. We rely on the group's own listings.

6. Active threat actors: presence, motivation, and TTPs

Seven actors account for 14 of the 17 claims. Their public technical detail comes from global incident reporting, not from the Saudi cases. We have no incident-level evidence from Saudi victims, so read the tradecraft below as what each actor is known to do, not proof of what happened to a named Saudi company. Technique IDs refer to MITRE ATT&CK.

Summary: motive and presence

What the actors share

Brands differ, but behavior converges. The matrix shows which techniques each major group is documented using. A technique that many groups share is a better detection target than any single group’s indicators.

Marks reflect public reporting on each group worldwide, not Saudi incident evidence.

Actor profiles

The long tail

• Tengu. First observed in late 2025, financially motivated, thinly documented. One claim in each of the Kingdom (14 January) and the UAE (25 February).
• Gammax, Panzer. No reliable public profile. We treat them as unprofiled and assume commodity tradecraft until evidence says otherwise.

Before 2026: government claims moved off the leak sites

In 2024 and 2025 Saudi government and military targets appeared on ransomware leak sites: a military service council (RansomHub, August 2024), the Royal Saudi Air Force and a military and government internal center (KillSec and Babuk-Bjorka, April 2025), and the Taif Municipality portal (Kazu, November 2025). The Iran-linked persona Abrahams_Ax, tied to the older Moses Staff cluster, published Saudi Ministry of Interior data with propaganda. In 2026 our leak-site data holds no such claim against a Saudi government body. Those claims now live on forums, where the volume is higher and the proof is thinner. That shift matters because forums reward volume and noise, so government claims there need more scrutiny before escalation.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. We reviewed 36 Saudi-targeted forum posts published between 23 August and 9 October 2026. That is a seven-week window, so we read it as a snapshot of the market, not a trend. We name no victims here, with one exception (Case 6) where a forum post matches a leak-site claim. The claims are unverified, many are recycled, and naming a target would amplify an unproven claim.

What the 36 posts target

• Government, defense, and security: 6 (17%). Claims against ministries, military and intelligence bodies, an 80,000-record regulator dataset, and a weapons-related document. The highest stakes and the least verifiable. Expect a share to be old, public, or fabricated.
• Logistics and delivery: 6 posts, 5 companies. Consumer-facing platforms that hold addresses, phone numbers, and order histories at scale.
• Network access for sale: 2. A VPN access listing, and access to a manufacturing company advertised with a "30kk+" tag. In forum usage "kk" usually means thousands of thousands, so the figure is probably about 30 million, but the seller does not say what it measures.
• Healthcare: 2. Two hospitals, one described as a large military facility.
• Finance, consumer goods, telecom and media, hospitality: 1 each. Plus 1 listing of roughly 9 million personal records, 2 holding groups, and 2 technology firms.
• Unclassified: 11. Mostly domain names with no further description.

Who is posting

Twenty-five handles produced the 36 posts, and a few dominate. One operator family, posting as UWAYS and UWAYS QARANI, accounts for 6 posts spread across government, healthcare, logistics, and technology. Working that many sectors at once is the profile of a data broker reselling aggregated or old material. Seven more handles posted twice each. Together, eight operators account for 20 of 36 posts (56%).

Six of the handles also appear in our UAE forum sample over the same weeks (DaOnlySpark, Keishell, 4ss3, honeydutch, Anonymous2090, and s-root). That is a regional seller base working both markets, and it is why a Saudi claim and a UAE claim by the same handle should be investigated together.

Motives mix. Most posts are commercial: someone is selling data or access. Four carry hacktivist branding, Anonymous-style or national cyber-team names, yet they target hotels, hospitals, and holding companies as readily as government. Ideology is thin. Visibility is the product.

Recycling and rhythm

Post counts overstate victims. One domain appeared three times from two handles in 13 days, and another twice from the same handle in two days. The 36 posts cover roughly 33 distinct targets. Case 6 above follows the domain that appeared three times.

Weekly volume was lumpy: 7, 5, 6, 3, then 10 posts in 22 to 30 September, and 5 in the first nine days of October. Bursts follow seller inventory and attention cycles, not the news.

Why this matters for ransomware risk

Access listings are the front end of the ransomware chain. Affiliates buy access, then encrypt and extort. The manufacturing listing has the same profile as the industrial victims in the leak-site stream: a mid-sized Saudi firm with remote access exposed. We cannot link any listing to any claim and we do not. The pipeline of a forum listing, then days or weeks, then a leak-site post is the reason to watch forums and not leak sites alone.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. For government and military claims, verify before you escalate. Check whether the data is old or public, whether it matches your records, and whether the poster offers sample files.

8. Update outside the report window: October 2026

On 3 October a group calling itself Wallstreet claimed a breach of the Saudi branch of a China Railway Construction consortium building the Jeddah Central stadium for the 2034 World Cup. It alleges 17 TB and 1.5 million files, including contract documents, payment certificates, and personal data on over 150,000 employees. We have not verified the claim and it falls outside this report’s window. We include it because it is the pattern in this report at its largest: a supplier holding the crown jewels of a national program. Wallstreet is unprofiled.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public regional reporting. The consistent picture:

• Vulnerability exploitation leads. Positive Technologies attributes 38% of Gulf incidents to it, followed by malware (31%) and social engineering (27%). Legacy industrial systems are part of the cause.
• Edge devices are the door. Unpatched firewalls and VPN gateways recur across CloudSEK, CYFIRMA, and vendor reporting.
• Access is bought. Initial access brokers and stolen credentials feed affiliates who never touched the target before the sale.
• AI is entering the workflow. CloudSEK reports Iran-linked MuddyWater using Gemini for tool development and APT42 using AI for phishing lures. It is an accelerant, not a new technique.

10. The regulatory frame

Two regimes overlap. The National Cybersecurity Authority (NCA) published the NCNICC-1:2025 controls for private entities outside critical infrastructure; the primary text is on the NCA site, and we have taken the tiering and adoption date from law-firm summaries rather than from our own reading of the full document. Separately, the Saudi Data and AI Authority (SDAIA) administers the Personal Data Protection Law (PDPL) and its Implementing Regulations. SDAIA’s own breach-notification service describes the rule in force under Article 24 of the Implementing Regulations: notify SDAIA within 72 hours of becoming aware of a breach likely to harm the personal data, the data subject or their rights. The penalty provisions (Articles 35 and 36 of the law) are known to us only through law-firm commentary, which puts them at up to SAR 5 million; we have not checked those figures against the official text. SDAIA published draft amendments for consultation from 6 October to 5 November 2026 that, according to the same commentary, would drop the harm threshold for notifying SDAIA. They are proposals, not rules in force, and may change. A double-extortion incident can therefore raise both an NCA control question and a PDPL question, and listed issuers may have market disclosure duties on top. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. Q4 will stay at or above Q3. One claim was recorded in the first three days of October 2026. Nothing suggests the supply of affiliates or access is shrinking. We assess this as likely.
2. Third-party compromise becomes the headline. Expect more claims against contractors, consultancies, and outsourced IT where the real target is a named client.
3. The Gentlemen keep the Kingdom in view. Four claims in 31 days is not a pause pattern. We expect at least two more Saudi claims from the group before year-end.
4. Fragmentation continues. Expect at least five new group names with Saudi victims. Defend against behaviors, not brands.
5. Access listings will surface as claims. Expect some forum-listed Saudi mid-market access to reappear as leak-site victims within weeks.
6. The war stream is a wildcard. A ceasefire lowers wiper risk. Escalation raises it fast, and energy, water, and government sit first in line.

12. What to do this quarter

1. Patch the edge first. Inventory every internet-facing VPN, firewall, and remote access gateway. Set a proposed internal target of 72 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Hunt for your own credentials. Check infostealer logs and broker markets for employee and vendor accounts. Reset what appears, and revoke sessions as well as passwords. This is the cheapest control on the list.
3. Rank your suppliers by what they hold. Find the five outside firms with the most sensitive data on you, starting with consultants, contractors, and joint-venture repositories. Ask each for evidence of MFA on remote access, EDR coverage, and offline backups.
4. Assume the EDR will be killed. Alert on driver loads and on security services stopping. Do not rely on a single agent as the last line.
5. Separate the wiper plan from the extortion plan. Offline, tested restores for wipers. Legal, communications, and negotiation readiness for data theft. They are different exercises.
6. Prepare for coercion of staff. Some groups approach IT and finance staff directly. Give employees a safe, fast way to report an approach, and treat it as an incident.
7. Rehearse the double-extortion call. Who talks to the NCA, who to SDAIA, who to Tadawul if you are listed, who to the board, and who decides on negotiation. Write it down and test it.
8. Watch for your name. Leak sites, Telegram channels, and broker forums post your data before you hear about it. Detection there buys days.

Sources

• National Cybersecurity Authority, NCNICC-1:2025 controls (primary text, Arabic)
• SDAIA, Personal Data Breach Notification service (Article 24 rule as described by the regulator)
• Clyde & Co, SDAIA publishes draft amendments to the PDPL (secondary source for Article 24 and the consultation dates)
• Check Point Research, The State of Ransomware Q1 2026
• The National, Ransomware activity rises across Middle East (CloudSEK data)
• Positive Technologies H1 2026 Gulf findings, via TECHx
• CYFIRMA, Converging Threat Vectors: Saudi Arabia 2025 to 2026
• 2026 Iranian strikes on Saudi Arabia (event timeline)
• Picus Security, Handala threat group profile
• Check Point Research, Handala Hack: unveiling the group's modus operandi
• Hive Pro, Handala claims destructive wiper attack on GCC nation
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• Cybereason, The Gentlemen ransomware
• Sophos, GOLD IONIC deploys INC ransomware
• Proven Data, Qilin attack chain and MITRE ATT&CK TTPs
• Blackpoint Cyber, DragonForce threat profile
• CloudSEK, Unmasking media-hungry ransomware groups: Bashe and APT73
• SOCRadar, Dark Web Profile: Krybit
• CMS, NCA Cybersecurity Controls for the Private Sector

Sources are linked in their original language.