United Arab Emirates Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, United Arab Emirates
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for The United Arab Emirates, checked 7 Nov 2026. The council publishes no threat level and signals threat by announcing foiled attacks and daily attack attempt counts.
Source: The National
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
| United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Daily breach attempts against the UAE | 90,000 to 200,000 | February 2026 | The National |
| Daily cyberattack attempts against the UAE | more than 800,000 | July 2026 | Khaleej Times |
| Attacks in a single day | 640,000 | 15 September 2026 | The National |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| IRGC (Islamic Revolutionary Guard Corps) | State-aligned | Council head Mohamed Al Kuwaiti named Iran a main player in attacks on the UAE in September 2026 and said the IRGC was behind many of them. | The National |
Laws and rules this year
Full stories
Official statements
- 16 Sep 2026Council head Mohamed Al Kuwaiti told CNN the IRGC was behind many attacks on the UAE and that AI has accelerated cyberattacks. The National
- 3 Jul 2026The council said it thwarted attacks on several financial sector entities and urged entities to report suspicious activity through official channels. Khaleej Times
- 21 Feb 2026The Cyber Security Council said it thwarted organised cyberattacks of a terrorist nature aimed at disrupting essential services, built with AI tools. Aletihad
Incidents
8 of 8 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ⚠️ Claimedflydubai | 7 Oct 2026 | Transport | Ransomware | Claimed. Everest listed the airline and claimed 4.36 GB of data, including records on 2,862 employees and pilot training material. No samples were published. | Cybernews · TechInformed✓ 8 Nov | |
| ✅ ConfirmedUAE aviation, energy and education sectors | 16 Sep 2026 | Other | Intrusion | None | Confirmed. The council said national teams detected and contained advanced, organised attacks on the aviation, energy and education sectors in August 2026 before they disrupted vital systems. | The National✓ 7 Nov |
| ✅ ConfirmedSeveral UAE financial sector entities | 3 Jul 2026 | Finance | Intrusion | None | Confirmed. The council said it thwarted sophisticated cyberattacks on several financial sector entities and kept financial services running. | Khaleej Times✓ 7 Nov |
| ⚠️ ClaimedDubai Courts, Dubai Land Department and RTA | 13 Apr 2026 | Government | Intrusion | Claimed. Handala claimed it breached the three Dubai government bodies, destroyed 6 PB of data and stole 149 TB. The claims are unverified. | Security Affairs✓ 8 Nov | |
 ⚠️ ClaimedDubai International Airport | 2 Apr 2026 | Transport | Data leak | Claimed. The suspected Iran-linked group Nasir Security began leaking passport photos, luggage images and security scanner photos it said came from a months-long breach of the airport. | SC Media✓ 8 Nov | |
| ⚠️ ClaimedSharjah National Oil Corporation | 3 Mar 2026 | Energy | Intrusion | Claimed. Handala posted the company on its leak site and claimed to have taken 1.3 TB of financial data, oil contracts and project files. | ransomware.live✓ 8 Nov | |
| ✅ ConfirmedUAE digital infrastructure and vital sectors | 21 Feb 2026 | Government | Intrusion | None | Confirmed. The UAE Cyber Security Council said it thwarted organised attacks of a terrorist nature that used network intrusion attempts, ransomware and phishing against national platforms. | Aletihad · The National✓ 7 Nov |
| ✅ ConfirmedAbu Dhabi Finance WeekVia a vendor | 17 Feb 2026 | Finance | Data leak | None | Confirmed. More than 700 passport and ID scans of conference attendees sat on an unprotected cloud server. ADFW blamed a vulnerability in a third-party vendor-managed storage environment and said it was secured once identified. | Middle East Eye✓ 8 Nov |
FAQ
Does United Arab Emirates have a national cyber threat level?
No published national cyber threat level was found for The United Arab Emirates (checked 7 Nov 2026). The council publishes no threat level and signals threat by announcing foiled attacks and daily attack attempt counts.
Which organisations in United Arab Emirates confirmed cyber incidents recently?
4 incidents confirmed since January 2026: UAE aviation, energy and education sectors, Several UAE financial sector entities, UAE digital infrastructure and vital sectors and Abu Dhabi Finance Week.
Which United Arab Emirates organisations appear on ransomware or leak sites?
4 claims, not confirmed by the organisations: flydubai, Dubai Courts, Dubai Land Department and RTA, Dubai International Airport and Sharjah National Oil Corporation.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.