No, thank you: Shukran hack a reminder financial details not essential for fraud

The hack of Landmark Group's Shukran loyalty programme may have yielded only basic user information, but this data could still be used to launch more severe fraudulent activities. Dubai-based Landmark Group disclosed on Wednesday that a cyber incident involved "unauthorised access" to Shukran, accessing customer names, contact details, and dates of birth.

Analysts warn that this type of data can facilitate convincing impersonation scams, phishing messages, and other social engineering tactics, which coerce victims into revealing sensitive information. Security researcher Mohamed Emam from Group-IB, a Singapore-based cybersecurity firm, stated to The National that even without financial information, exposed customer data can still prove valuable to cybercriminals.

Stolen data can disseminate rapidly through the dark web, online forums, illicit marketplaces, and private messaging channels within mere minutes, or often even instantly. According to Maher Yamout, a lead security researcher at Kaspersky, stolen information can be combined with data from previous breaches to create detailed profiles of individuals.

This process often occurs two years after the initial data theft, during the archive and enrichment phase. The stolen data can also be utilized to weaponize victims' other accounts, such as coercing them to reset bank app passwords. In the case of Shukran, although the stolen data may seem less severe than passwords or payment card details, it remains valuable to criminals.

Danny Jenkins, CEO and co-founder of US cybersecurity company Threatlocker, told The National that even seemingly basic personal information can be used to establish credibility and tailor attacks to individual victims, potentially resulting in phishing attacks, identity fraud, account takeover attempts, or financial scams.