dasholding.ae Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized enterprises and holding companies across the Middle East, using leak-site listings to pressure victims after claimed data theft. In this landscape, the appearance of dasholding.ae on a LockBit3 site in mid-September 2023 fits a familiar pattern of asserted exfiltration without immediate public confirmation of scale or method.

Public records show that dasholding.ae, identified as Das Holding, a United Arab Emirates-based holding company and conglomerate with roughly 129 employees, was listed by the LockBit3 ransomware group on 16 September 2023. The group claims internal files were taken in a ransomware attack. The number of people affected remains unknown, and independent verification of the full scope has not been widely published. For employees, partners, and anyone who has shared information with the organisation, the listing raises practical questions about what may now be circulating.

What happened

On 16 September 2023, dasholding.ae appeared on the leak site associated with the LockBit3 ransomware group. According to the listing, the incident involved a ransomware attack in which internal files were exfiltrated. No public details have stated the precise date of initial access, the entry vector, whether encryption was deployed alongside theft, or any ransom demand. The number of individuals affected is listed as unknown. Available summaries describe the organisation simply as Das Holding, operating in business information, holding companies and conglomerates in the United Arab Emirates, with approximately 129 employees. Beyond the group’s claim of internal-file exfiltration, further technical or forensic particulars remain undisclosed in public reporting.

Who is lockbit3?

LockBit3 is a well-documented ransomware operation that has functioned as a Ransomware-as-a-Service (RaaS) brand. Affiliates gain access to victim networks, exfiltrate data, and often deploy encryption, after which the core group hosts stolen material on a dedicated leak site if payment is not made. The operation is known for high-volume targeting across sectors and geographies, double-extortion tactics that combine encryption with the threat of data publication, and frequent updates to its tooling and branding. Listings on its site constitute claims by the group; they are not independent confirmation that every asserted detail is accurate or that every named file set has been released. In this case, LockBit3’s listing of dasholding.ae should be read as the group’s assertion that it obtained internal files, rather than as verified fact from the victim or external investigators.

dasholding.ae and its sector

Das Holding, operating as dasholding.ae, is described in available summaries as a United Arab Emirates holding company and conglomerate active in business information and related corporate activities, with a workforce on the order of 129 people. Holding companies of this type typically sit above operating subsidiaries or investment interests; they commonly maintain corporate records, financial and contractual documents, employee and contractor information, and correspondence with banks, regulators, and commercial partners. A breach affecting such an entity can therefore touch both internal staff data and information belonging to affiliated businesses or counterparties. Because holding structures often centralise sensitive documentation, unauthorised access can have consequences that extend beyond a single operating company. Public detail on Das Holding’s precise portfolio and data holdings is limited, so the exact organisational impact cannot be stated with certainty from open sources alone.

What data was at risk

The only data type named in connection with the incident is “internal files” said to have been exfiltrated in a ransomware attack. No further breakdown—such as whether the material included employee records, financial statements, customer or partner contracts, credentials, or intellectual property—has been disclosed in the available facts. Organisations of this kind routinely store personnel files, payroll and benefits data, board and legal documents, banking and tax records, and commercial agreements. Any of those categories could theoretically have been present among internal files, yet the exact contents remain unconfirmed. Readers should treat specific claims about named individuals or document types as unverified unless corroborated by the organisation itself or by independent analysis of released material.

What's at stake

For people whose information may have been among the internal files, the concrete risks include potential misuse of personal or employment details for phishing, identity fraud, or social-engineering attempts against banks or government services. Business partners and counterparties face possible exposure of contractual terms, pricing, or negotiation history, which can affect commercial leverage or invite follow-on targeting. For the organisation, a confirmed or widely publicised leak can disrupt operations, trigger regulatory notification duties under applicable UAE and international rules, and damage trust with employees and investors. Because the number of affected individuals is unknown and the precise file set is undisclosed, the full extent of these risks cannot yet be quantified. The absence of public confirmation does not eliminate the possibility that data has already been copied or offered for sale.

What to do if you're exposed

If you have worked for, contracted with, or shared personal or corporate information with dasholding.ae or Das Holding, treat the LockBit3 listing as a reason for heightened caution. Monitor financial and email accounts for unexpected activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference the company or recent business dealings. Consider placing fraud alerts with relevant credit or identity services if you are in a jurisdiction that offers them. Retain any official notices the organisation may issue. As a practical additional step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which may help you prioritise further monitoring and password changes.

AICompiled with AI assistance from public sources and published under our editorial standards.