Du Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Du was listed by the dragonforce ransomware group on November 20, 2025, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; anyone connected to Du should verify whether their data was exposed and take appropriate protective steps.
On November 20, 2025, the ransomware group dragonforce listed Du on its leak site, stating that internal files had been taken from Emirates Integrated Telecommunications Company P.J.S.C. The number of people affected and the volume of data remain undisclosed. For customers and staff of one of the UAE’s two primary telecommunications providers, the listing raises the possibility that records held by the operator could be exposed or misused.
Telecommunications companies routinely process identifiers, account details and service records that can be used for identity-related activity or targeted fraud. When such an operator appears on a ransomware listing, the practical question is what was taken and whether it can be linked to individuals.
Inside the incident
The only confirmed public information is the November 20, 2025 listing itself. The group claims internal files were exfiltrated during a ransomware attack. No figure for the number of records, the date of the intrusion, or the method of access has been released by Du or independently verified. The scale of the operation and whether data was subsequently published or sold are not known from available reporting.
The group behind it: dragonforce
Dragonforce is a ransomware operation that maintains a public listing of claimed victims on hidden services. The group typically announces intrusions after encrypting systems and exfiltrating material, then uses the listing to pressure organisations into negotiations. Its listings are presented by the group as evidence of successful access; independent confirmation of each claim is not always available at the time of posting.
About Du
Du is the commercial name of Emirates Integrated Telecommunications Company P.J.S.C., one of the two licensed telecommunications operators in the United Arab Emirates. The company provides mobile and fixed-line telephony, internet access, digital television and carrier services, and operates subsidiaries that support data and satellite infrastructure. As a national-scale provider it holds large volumes of customer, billing and network records required to deliver these services.
The information in question
The listing refers only to “internal files.” The precise categories of data have not been disclosed. Organisations of this type commonly store customer names, national identifiers, contact details, service contracts, billing histories and network authentication records. Without a published inventory it is not possible to state which of these categories, if any, were removed.
The real-world impact
Telecommunications data can be used to impersonate account holders, intercept communications or map personal and business relationships. For the organisation, an unconfirmed claim of exfiltration creates uncertainty for regulators, partners and customers until a full assessment is completed and any required notifications are issued. Both the individual and corporate consequences depend on the actual contents of the files, which remain unconfirmed.
Were you affected?
Du has not published a list of affected individuals. The following steps are standard after any incident involving a telecommunications provider:
- Monitor official statements from Du for confirmation and any offered remediation.
- Review recent account activity for unexpected changes in service or billing.
- Run a free exposure scan of your email address against known breach data to check for prior appearances of your information.
- Consider using unique passwords and enabling any available account-protection features on services linked to your Du account.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
VoiceTeam Call Listed by dragonforce Ransomware GroupMobilelink USA Listed by dragonforce Ransomware GroupABM Wireless INC Listed by dragonforce Ransomware GroupPay Tel Communications Listed by dragonforce Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Du Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.