Raqib Data Breach

UmBra ransomware added Raqib, a technology company based in Saudi Arabia, to its dark web leak portal on October 7, 2026. Raqib specializes in providing digital solutions and services within the Saudi market. This listing was identified through SOCRadar’s Dark Web Monitoring service. The technology sector, particularly in regions like the Middle East, can be an attractive target for ransomware groups due to the sensitive data they handle and their critical role in digital infrastructure. In the past 60 days, UmBra has claimed at least four other victims: SANAtech Global Solutions (Egypt, technology), Tharisa (South Africa, manufacturing), Four Hands LLC (US, other), and Beni Suef Technological University (Egypt, education). The group’s primary geographic focus includes Egypt, South Africa, and Saudi Arabia. Raqib represents UmBra’s second reported victim in the technology sector, with SANAtech Global Solutions being a similar industry target.

Stealer-log telemetry for the domain raqib.com.sa returned no records within the queried sample. It is important to note that a null result does not confirm that the organization is unaffected. The query covered a bounded, paginated subset of available data, and it is possible that credentials exist under alternate corporate domains or were accessed via staff personal email aliases, which may not have appeared in the results. Therefore, the absence of positive signals in this specific query should be treated as a lack of evidence rather than definitive proof of no compromise. Continued active monitoring is recommended to ensure ongoing security. The potential for infostealer-harvested credentials to support ransomware operations remains a significant concern, especially if access to corporate accounts, Microsoft 365, VPNs, or remote-access portals is gained through such means. Given the limitations of the stealer-log query, proactive security measures are advised. This includes continued dark web and stealer-log monitoring, thorough credential hygiene checks, regular password rotation, and comprehensive review of multi-factor authentication configurations. Additionally, monitoring alternate corporate domains and reviewing activity logs for Microsoft 365, VPNs, and remote-access portals are crucial steps to detect and prevent potential intrusion paths.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.