Du Listed by dragonforce Ransomware Group

Emirates Integrated Telecommunications Company, operating as du, was listed on the DragonForce ransomware group’s leak site on November 20, 2025, after the attackers claimed to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates that DragonForce posted a listing for du, one of the two primary telecom operators in the United Arab Emirates. The company provides mobile, fixed-line, internet, and digital television services to customers across the country, along with carrier services, data hub facilities, and satellite broadcasting support. Available reporting describes the exposed material as internal files, though the precise volume and exact nature of the documents remain unconfirmed by the company at the time of writing. No specific victim count or list of stolen customer records has been publicly detailed on the leak site.

November 20, 2025 marks the date the group added du to its public extortion page. The listing follows the typical DragonForce pattern of announcing a successful compromise and threatening further data release unless demands are met.

Why This Matters for You and Your Family

When a major telecom provider like du suffers a breach, the ripple effects reach ordinary customers who rely on its mobile, internet, and television services. If your phone number, billing address, email, or account details were among the internal files taken, those records can be combined with other leaked information to build a profile that puts your family at risk. Telecom data often includes payment records, service addresses, and device identifiers that feel routine until they appear on dark-web marketplaces.

Internal files from a company the size of du can contain spreadsheets or databases that link real identities to phone numbers, email addresses, and account histories. Once that information leaves the company’s control, it travels quickly through criminal networks. For families in the UAE or anyone who has ever held a du account, the exposure creates a permanent record that can be reused for years.

The Doxxing and Identity-Chain Implications

Stolen telecom records rarely stay isolated. A single leaked phone number or email can be correlated with usernames on social media, gaming platforms, and shopping sites. Attackers follow these identity chains to locate additional personal details, turning one breach into a cascade of exposures. Public reporting on similar incidents shows that credential leaks frequently lead to account takeovers on unrelated services where the same password was reused.

Gaming accounts belonging to you or your children are especially vulnerable in these chains. A compromised parent email or shared family address can give attackers the foothold they need to hijack a child’s Fortnite, Roblox, or other gaming profile, then use in-game chat logs or linked payment methods to gather even more personal information. The result is doxxing that can include home addresses, family relationships, and daily routines.

DragonForce’s Publicly Known Track Record

Public reporting attributes the DragonForce ransomware group with emerging in 2024 and rapidly building a reputation for aggressive double-extortion tactics. The group has listed victims ranging from mid-sized enterprises to larger organizations across multiple countries, typically gaining initial access through phishing, remote desktop protocol weaknesses, or stolen credentials. After exfiltrating data, DragonForce follows a consistent playbook: it publishes a sample of stolen files on its leak site, sets a short deadline for payment, and threatens to release the full archive if the victim does not pay. Exact prior victim counts and success rates are difficult to verify, but industry trackers note the group’s steady activity throughout 2025.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains exist from this claimed breach.
• Rotate any password you used for your du account or related services and enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and emails.
• Let remediation specialists handle the time-consuming work of sending takedown notices to data brokers and monitoring platforms where your information surfaces.

The incident underscores a simple reality: one major breach can quietly feed dozens of future attacks against you and your family. Taking deliberate steps now limits how far the stolen data can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also protects children’s gaming accounts that frequently become targets once a family link is established.