Department of Culture and Tourism Abu Dhabi Listed by everest Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 26 May 2025 the Department of Culture and Tourism Abu Dhabi was listed by the ransomware group known as everest. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical details have not been released.

The listing itself is a claim made by the group. For an organisation that oversees cultural heritage, museums, libraries and tourism across Abu Dhabi, any confirmed compromise of internal material raises practical questions about operational continuity and the possible exposure of administrative records.

Breaking down the breach

According to the available record, the Department of Culture and Tourism Abu Dhabi appeared on everest’s leak site on 26 May 2025. The sole description provided is that internal files were allegedly exfiltrated during a ransomware attack. No figures for the volume of data, no list of specific file categories, no timeline of the intrusion, and no confirmation of encryption or ransom demand have been made public. The number of individuals whose information may be involved is listed as unknown. At present the incident rests on the group’s claim of listing and the brief characterisation of the material as internal files; independent verification of the scope or method has not been published.

Inside everest

Everest is a ransomware operation that has maintained a public leak site for several years. Like many groups in this category, it typically follows a double-extortion model: data are copied from a victim network, encryption is applied to systems, and the stolen material is threatened with release unless a payment is made. The group has previously listed organisations across government, healthcare, education and commercial sectors, using the leak site both to pressure victims and to advertise its activity. Public technical reporting associates everest with standard ransomware tooling and affiliate-style recruitment, though the precise infrastructure and membership change over time. In the present case the only claim attributable to the group is the listing of the Department of Culture and Tourism Abu Dhabi and the assertion that internal files were taken; no further statements by everest about this victim have been recorded in the available facts.

About Department of Culture and Tourism Abu Dhabi

The Department of Culture and Tourism Abu Dhabi, often abbreviated DCT Abu Dhabi, is the government body responsible for conserving and promoting the emirate’s heritage and culture while supporting tourism as an economic driver. Its work includes organising festivals, developing museums, managing libraries, and overseeing the broader tourism sector so that Abu Dhabi remains a recognised destination. Organisations of this type routinely handle administrative records, staff information, contractor details, visitor-related data, event planning documents, and cultural-asset inventories. A breach affecting such an entity therefore touches both public-service functions and the commercial tourism ecosystem that depends on the department’s programmes and partnerships.

The information in question

The facts state only that internal files were exfiltrated. No inventory of the files, no confirmation of personal data categories, and no statement of whether visitor, employee or partner records were included have been released. Government cultural and tourism bodies typically maintain personnel files, financial and procurement records, correspondence with cultural institutions, event-registration lists, and operational planning documents. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the material claimed by everest. Readers should treat any more specific description as speculative until official clarification is issued.

What's at stake

If internal files have been taken, the immediate risks include disruption of day-to-day cultural and tourism operations, potential misuse of administrative or contact information, and reputational pressure on the department and its partners. Individuals whose details appear in those files—staff, contractors, festival participants or tourism operators—could face phishing, identity-related fraud or unwanted contact if the material is later published or sold. For the organisation itself the stakes involve continuity of public programmes, possible regulatory scrutiny under applicable data-protection rules, and the cost of investigation and remediation. Because the scale and precise content remain undisclosed, the actual impact cannot yet be quantified; the prudent course is to assume that any sensitive internal material could be leveraged until proven otherwise.

Were you affected?

If you have had dealings with the Department of Culture and Tourism Abu Dhabi—as an employee, contractor, event participant or tourism partner—monitor official statements from the department for any notification or advice. Change passwords on related accounts, enable multi-factor authentication where available, and remain alert to unexpected emails or messages that reference cultural events, tourism services or Abu Dhabi government contacts. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a check provides an early indication but does not replace official guidance once further details emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.