Emirates Flight Catering Data Breach

Emirates Flight Catering, a hospitality organization based in the United Arab Emirates, has been identified on the Everest ransomware group’s dark web portal, with the listing published on August 5, 2026. This discovery was made through SOCRadar’s Dark Web Monitoring service. The company operates within the aviation catering and hospitality sector, a crucial service function directly supporting airport and airline operations. It is one of three entities from the UAE that have been claimed by Everest in its recent victim listings. In the 60 days preceding this listing, Everest has claimed responsibility for 18 other victims, showcasing a distinct targeting pattern that favors the technology, professional services, and energy and utilities sectors. Geographically, the ransomware group’s activities are primarily concentrated in the United States, India, and the United Arab Emirates. Other organizations from the UAE that have been recently listed by Everest, similar to Emirates Flight Catering, include Al-Futtaim Group, NIMR Oil, Keysight, and Stadler Rail. While the hospitality sector is not Everest’s most frequent target during this period, the concentration of victims within the UAE represents a stronger pattern, which this new listing further exemplifies.

SOCRadar’s analysis of initial access vectors, cross-referenced with stealer-log telemetry, revealed a significant exposure associated with the emiratesflightcatering.com domain. A sample of 13 records indicated authentication against the organization’s own domain. However, most usernames were masked generic handles, making it difficult to definitively attribute them to employees. Only two records could be confidently classified, and these appeared to be external or customer-user credentials rather than employee information. This finding suggests activity focused on organization-controlled infrastructure, with a pattern leaning towards account takeover rather than direct employee compromise. Furthermore, the log dates in the analyzed slice are notably older compared to similar cases. For ransomware groups like Everest, credentials harvested by infostealers are a known method for initial access. Threat actors or initial access brokers typically source these logs from underground markets, validate corporate credentials, and then use them to access systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the stealer-log evidence does not definitively confirm that these specific credentials were used by Everest, and the masked nature of the sample limits definitive conclusions, it points to persistent credential exposure on the organization’s login surfaces. Given the observed credential exposure, it is recommended that CTI teams continue monitoring for employee-level records that might not be revealed in a masked, paginated sample. Continued dark web monitoring and proactive credential hygiene checks, including password rotation and multi-factor authentication review for Microsoft 365, VPNs, and remote-access portals, are advised. The limited nature of the analyzed data and the older log dates necessitate ongoing vigilance to uncover any further evidence of compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.