Shukran Breach Data Could Reach Criminal Forums Within Hours, Researchers Warn

The Dubai-based conglomerate said on Wednesday it was investigating a cyber incident involving "unauthorised access" to Shukran that involved customer names, contact details and dates of birth. Shukran's initial assessment on its website was unchanged on Saturday.

The attackers may have obtained only basic information. Analysts caution that this kind of data can still be used for convincing impersonation scams, phishing messages and other social engineering meant to pressure victims into revealing sensitive information.

"The key concern is that a data breach does not need to involve financial information to create opportunities for financial fraud," said Mohamed Emam, a security researcher at Singapore-based cybersecurity firm Group-IB. "Even when financial information is not compromised, exposed customer names and phone numbers can still be valuable to cybercriminals."

Emam said compromised data may be offered for sale or shared on underground forums within hours of being obtained, depending on the nature of the breach and what the attacker intends. Not every breach leads to immediate publication or sale, he added. Some attackers keep the information for their own operations or distribute it privately.

Maher Yamout, a lead security researcher at Kaspersky, said stolen records "can also be combined with information obtained from previous breaches to build more detailed profiles of individuals". In the worst case, he said, names, phone numbers and dates of birth give criminals the means to establish credibility and tailor their approach to individual victims.

"This could lead to phishing attacks, identity fraud, account takeover attempts or financial scams if the method of the attack is convincing enough to trick victims into disclosing additional information or security credentials," Yamout said.

If scammers obtain login credentials, verification codes or other authentication details, the damage could extend to account takeover, unauthorised transactions or identity-related fraud, Emam said. One example is a scammer who calls a victim and talks them into resetting their bank app password. "The immediate concern is not necessarily what criminals can do with a phone number alone, but what they may convince someone to reveal by using that information to gain their trust," Emam said.

Danny Jenkins, chief executive and co-founder of US cybersecurity company ThreatLocker, said this kind of information is typically sold to other criminal organisations on the dark web for use in future attacks on consumers. "Containing a breach is essential, but it does not mean the risk to affected customers has gone away," he said. "Even if the most sensitive data has been protected, any personal identifiable information can be of value to criminals."

New York-based data privacy company Cloaked describes a typical path for stolen data. It starts with a triage window of 24 to 72 hours in which records are sorted and tested before reaching a marketplace. General sale in bulk follows from the second to the eighth week, then cheaper commodity sales of data pooled from several breaches between the third and 12th month. About two years after the theft comes an archive and enrichment phase, when old records are combined with newer data in the way Yamout described.