Corniche Hotel Abu Dhabi Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Corniche Hotel Abu Dhabi has been listed by the dragonforce ransomware group, with internal files reported exfiltrated in an attack disclosed on June 12, 2026. The number of people affected remains undisclosed; anyone connected to the hotel should check for notifications and review their accounts for signs of compromise.
On June 12, 2026, the Corniche Hotel Abu Dhabi appeared on a listing associated with the ransomware group DragonForce. Public information states that internal files were exfiltrated during a ransomware attack, though the number of people affected and the precise contents of any data remain undisclosed.
The listing indicates that the hotel, located in Abu Dhabi’s Central Business District, was targeted. No further details on the scale, timing of the intrusion, or method of access have been released by the organisation or confirmed through independent reporting.
What happened
The incident came to public attention through the group’s leak-site listing on the reported date. The only confirmed element from available records is that internal files were removed from the hotel’s systems. All other aspects, including the total volume of data, the duration of unauthorised access, and whether any data was subsequently published, are not disclosed in the available facts.
The group behind it: dragonforce
DragonForce is a ransomware operator that maintains a public listing of claimed victims and uses data exfiltration as part of its operations. The group typically advertises stolen material on its site to pressure organisations into negotiations. Its listing of the Corniche Hotel Abu Dhabi constitutes a claim by the group; independent confirmation of the data’s authenticity or extent has not been provided in public records.
About Corniche Hotel Abu Dhabi
The Corniche Hotel Abu Dhabi operates a 305-room property in the city’s Central Business District, serving both business and leisure travellers. Hotels of this type routinely collect and store guest contact details, booking records, payment information, and internal operational documents. A compromise at such a facility can therefore involve records that span many years of customer interactions.
What was likely exposed
The only data category named in the listing is internal files. The exact nature of those files has not been published, so the following points summarise categories commonly held by organisations of this type:
- Guest registration and contact information
- Reservation and payment records
- Internal operational and administrative documents
Whether any of these categories were actually taken remains unconfirmed.
What's at stake
Individuals whose information appears in the exfiltrated files could face follow-on risks such as targeted phishing or misuse of payment details. For the hotel, the incident creates potential regulatory, reputational, and operational consequences, although the scale of those consequences cannot be assessed from currently available information.
What to do if you're exposed
Anyone who stayed at the hotel or conducted business with it should monitor their email and financial accounts for unusual activity. Changing passwords for any accounts linked to the hotel and enabling multi-factor authentication where available are immediate practical steps. Readers can also run a free exposure scan of their email address against known breach data to check whether their information has appeared in published records.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Al Ishrak Contracting Listed by dragonforce Ransomware GroupAl Shafar GRC Listed by dragonforce Ransomware GroupHong Kong Parkview Listed by dragonforce Ransomware GroupTaos Mountain Casino Listed by dragonforce Ransomware GroupLatest breaches
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.