etisalat.ae Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large telecommunications providers as part of a broader pattern of attacks on critical infrastructure and high-value data holders. In this landscape, claims of breaches against major carriers surface regularly on leak sites, often with limited independent verification at the outset. One such listing involves etisalat.ae, reported on February 16, 2024, as having been named by the LockBit3 ransomware group.

Public detail remains limited. The group claims that internal files were exfiltrated in a ransomware attack against Emirates Telecommunications Group Company PJSC, known as etisalat by e&. The number of people affected is unknown, and no further confirmed technical details have been released in the available record. For customers and partners of a major UAE telecom operator, any such claim warrants careful attention because of the sensitive nature of the data these organisations typically manage.

Inside the incident

According to the reported information, etisalat.ae was listed by the LockBit3 ransomware group on February 16, 2024. The listing asserts that internal files were exfiltrated during a ransomware attack. No public confirmation of the attack’s success, the precise method of intrusion, the volume of data taken, or the exact timing of any compromise has been provided in the available facts. The number of individuals potentially affected is listed as unknown. As with many ransomware claims, the listing itself constitutes an unverified assertion by the threat actor rather than independently corroborated evidence of a claimed breach.

No additional operational details—such as initial access vector, encryption of systems, ransom demand, or subsequent data publication—are included in the public record for this incident. Organisations named on ransomware leak sites sometimes later confirm or deny the claims; in this case, the facts supply only the listing and the description of internal files as the named data type.

Inside lockbit3

LockBit3 is a well-documented ransomware operation that has been active for several years under successive versions of the LockBit brand. The group typically operates a ransomware-as-a-service model, in which affiliates conduct intrusions and share proceeds with the core developers. Its standard tactics include network compromise, data exfiltration prior to encryption, and the threat of public release of stolen material on a dedicated leak site if a ransom is not paid. LockBit3 has historically targeted a wide range of sectors, including manufacturing, professional services, healthcare, and critical infrastructure, and has been associated with numerous high-profile listings.

The group’s leak site is used to pressure victims by advertising claimed breaches and, in some cases, releasing samples or full archives of stolen data. Public reporting on LockBit3 has described its use of double-extortion techniques and its efforts to maintain operational continuity despite law-enforcement actions against earlier iterations. In the present case, the facts state only that etisalat.ae was listed; no specific statements by LockBit3 beyond that listing, and no confirmation of data publication, are recorded here. Any claims made by the group regarding this victim should therefore be treated as unverified assertions.

Who is etisalat.ae?

Emirates Telecommunications Group Company PJSC, doing business as etisalat by e&, is a UAE state-owned telecommunications company. It ranks as the 18th largest mobile network operator in the world by number of subscribers. As a major national carrier, it provides mobile, fixed-line, broadband, and related digital services to a large customer base in the United Arab Emirates and, through its international operations, to markets beyond the region.

Telecommunications providers of this scale routinely handle customer identity and contact information, billing and payment records, call and data usage metadata, network infrastructure details, and internal corporate documents. Because they sit at the centre of national communications infrastructure, a successful compromise can carry implications for both individual privacy and operational continuity. The state-owned status of the company further elevates the potential sensitivity of any internal material that might be involved.

What data was at risk

The available facts name the exposed material as “internal files exfiltrated in ransomware attack.” No more granular inventory—such as customer databases, employee records, financial documents, or network diagrams—is provided. The exact contents therefore remain unconfirmed.

Organisations of this type typically hold substantial volumes of personal data belonging to subscribers, including names, contact details, identification numbers, service histories, and payment information, as well as proprietary operational and technical documentation. Whether any of those categories were among the internal files claimed by LockBit3 cannot be established from the public record. Readers should treat the scope of exposure as unknown pending further official disclosure.

What's at stake

For individuals whose information may have been among any exfiltrated files, the primary risks include potential misuse of personal identifiers for phishing, social engineering, or identity-related fraud. Even limited internal documents can contain enough contextual detail to make subsequent scams more convincing. Because the number of people affected is unknown and the precise data types are not itemised, the scale of personal impact cannot be quantified at present.

For the organisation, a ransomware incident—whether fully realised or merely claimed—can disrupt operations, generate regulatory and contractual scrutiny, and damage trust among customers and partners. Telecommunications providers are subject to heightened expectations around data protection and service resilience; any confirmed compromise of internal systems would therefore carry both practical and reputational consequences. Until more detail emerges, the concrete effects remain speculative.

What to do if you're exposed

If you are a customer or employee of etisalat by e& and are concerned that your information may have been involved, begin with basic protective steps: monitor account statements and credit activity for unusual transactions, enable multi-factor authentication on email and financial accounts where available, and treat unsolicited messages that reference the company or your personal details with caution. Change passwords on any accounts that reuse credentials associated with the service.

Because the full extent of any data exposure is unconfirmed, it is also useful to check whether your email address has already appeared in known breach datasets. Free exposure-scan tools can search public breach compilations and alert you to previously recorded compromises, giving an additional layer of visibility while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.