DGCX Listed by stormous Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a commodities exchange is named on a ransomware group's leak site, the immediate concern is not abstract cybersecurity jargon but the people whose working lives and personal details may sit inside the organisation's systems. Staff, trading partners, clients and counterparties connected to DGCX could face real-world consequences if internal files have left the organisation's control. Public detail remains limited, yet the listing itself is enough to warrant careful attention from anyone who has dealt with the exchange.

On 25 March 2023, DGCX was reported as listed by the ransomware group known as stormous. The group claims that internal files were exfiltrated in a ransomware attack. How many people may be affected is unknown, and the precise contents of those files have not been publicly itemised beyond the general description of internal material. For individuals and firms tied to Dubai's commodity markets, that uncertainty is itself part of the problem.

What happened

According to the available record, DGCX appeared on a stormous listing dated 25 March 2023. The reported summary states that internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been released. The method of initial access, the exact timing of the intrusion, the volume of data taken, and whether any ransom demand was paid or systems restored remain undisclosed in the public facts. What is known is the claim of exfiltration and the organisation's appearance on the group's leak-site roster. Until further verified information surfaces, the incident should be treated as an asserted ransomware event involving internal files rather than a fully documented breach with confirmed scope.

Inside stormous

Stormous is a ransomware operation that has followed the now-familiar double-extortion model used by many contemporary groups: encrypting systems while also claiming to steal data, then threatening to publish or sell that data if payment is not made. Like other actors in this space, the group maintains a leak site on which it lists victims and, in some cases, releases samples or larger archives to increase pressure. Public reporting on stormous has described typical tactics that include phishing or exploitation of exposed services for initial access, followed by lateral movement, data staging and encryption. The group has been associated with attacks across multiple sectors and geographies, though each listing must be evaluated on its own evidence.

In this instance, the facts establish only that stormous listed DGCX and claimed internal files were exfiltrated. No further statements from the group about this specific victim—such as sample file names, data volumes or deadlines—are included in the available record. The listing therefore stands as an unverified claim until independently confirmed or corroborated by the organisation or other reliable sources.

Who is DGCX?

DGCX is a subsidiary of the Dubai Multi Commodities Centre (DMCC), a strategic initiative of the Government of Dubai. Its mandate is to enhance commodity trade flows through the Emirate by providing physical, market, financial infrastructure and related services. In practical terms, an exchange of this kind sits at the intersection of trading firms, brokers, clearing participants, market data users and regulatory oversight. It typically handles order and trade information, participant onboarding records, settlement and clearing data, and internal operational documentation.

A breach affecting such an organisation is consequential because commodity markets depend on trust in the integrity and confidentiality of trading infrastructure. Disruption or exposure can affect not only the exchange itself but also the wider network of commercial relationships that rely on it. Because DGCX operates under a government-linked initiative, any incident also carries institutional and reputational weight beyond a purely private-sector event.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as employee records, client lists, financial statements, trading data or credentials—has been disclosed in the public record. Organisations of this type commonly hold personnel information, know-your-customer and onboarding files for market participants, contractual and legal documents, internal communications, system configurations and market-related operational data. Whether any of those categories were among the files claimed by stormous is unconfirmed.

Readers should therefore treat the precise contents as unknown. The claim of internal-file exfiltration is serious on its face, yet without an official inventory or independent verification it is not possible to state which specific data elements left the organisation's control.

What's at stake

For individuals, the practical risks depend entirely on what was actually taken. If personnel or participant records were included, affected people could face phishing, social-engineering attempts, or misuse of identity and contact details. Trading counterparties might see sensitive commercial information used for competitive or fraudulent purposes. Even purely internal operational files can assist later attacks if they contain system details, credentials or process descriptions. Because the number of people affected is unknown and the data types remain broadly described, the scale of personal impact cannot yet be measured.

For DGCX and its parent ecosystem, the stakes include operational continuity, regulatory and contractual obligations, and confidence among market participants. A ransomware event that involves claimed data theft can trigger notification duties, forensic investigation costs and longer-term scrutiny of security controls. None of these outcomes require assuming negligence; they follow from the nature of the claim and the role the organisation plays in commodity trade infrastructure.

Were you affected?

If you have worked for, traded through, or supplied services to DGCX or related DMCC entities, treat the listing as a reason for heightened caution rather than proof that your personal data is already public. Monitor financial and email accounts for unusual activity, be sceptical of unexpected messages that reference the exchange or commodity trading, and consider placing fraud alerts where appropriate. Change passwords on any accounts that reused credentials connected to work systems, and enable multi-factor authentication wherever it is available.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or rule out involvement in this specific incident, but it can indicate whether your details are circulating more widely and help you prioritise further protective measures while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.