Dubai Air Wing Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 13, 2026, the Dubai Air Wing appeared on a listing associated with the nova ransomware group. The group states that internal files were exfiltrated during a ransomware operation and claims possession of employee information and financial data. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public. This incident involves an aviation entity tied to UAE government operations at a time when ransomware groups continue to target organizations holding sensitive operational and personnel records.

What happened

The Dubai Air Wing was listed by the nova ransomware group on January 13, 2026. The listing indicates that internal files were taken during a ransomware attack. The group claims to hold employee information and financial data, though the scale of the exfiltration and the precise files involved have not been disclosed by the organization or verified through other sources.

Who is nova?

Nova operates as a ransomware group that typically deploys encryption malware against targeted organizations and then lists victims on a dedicated site to pressure payment. Such groups commonly exfiltrate data before encryption and use the threat of publication as leverage. The listing of Dubai Air Wing constitutes the group’s claim regarding this incident; no public confirmation from the victim or law enforcement has been reported.

Who is Dubai Air Wing?

The Dubai Air Wing, also referred to as the Dubai Royal Air Wing, functions as the paramilitary airline supporting the government of the United Arab Emirates. It operates a VIP terminal at Dubai International Airport dedicated to the Emir of Dubai, the prime minister, members of the Dubai royal family, and other senior government officials. Entities of this type routinely manage flight operations, personnel records, and financial transactions connected to high-level government travel.

The information in question

The facts released so far state that internal files were exfiltrated. The group claims these include employee information and financial data. The exact categories, volume, or sensitivity levels of the material remain undisclosed. Organizations in this sector commonly hold staff records, operational logs, and financial documentation, but the specific contents of the claimed exfiltration have not been confirmed.

The real-world impact

Exposure of employee information can lead to targeted phishing or identity misuse for affected individuals. Financial data, if verified, could create risks of fraud or further extortion attempts. For the organization, the incident may affect operational continuity and the handling of sensitive government-related movements, though the full consequences depend on the scope of data involved, which is currently unconfirmed.

Were you affected?

Individuals who have worked with or traveled through services connected to the Dubai Air Wing should monitor their personal accounts for unusual activity. A practical first step is to review bank and email statements for anomalies and to change passwords for any associated accounts. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in published records.

AICompiled with AI assistance from public sources and published under our editorial standards.