DUBAI, November 15, 2026 — Landmark Group is probing unauthorized access to customer data from its Shukran loyalty programme, confirming that names, contact details and dates of birth were exposed.
What Data Was Exposed
The breach involved basic personal identifiers: customer names, phone numbers and birthdays, as listed on the Shukran website’s initial assessment.
Why Those Details Fuel Phishing
Group‑IB researcher Mohamed Emam notes that even without financial records, names and phone numbers enable attackers to craft convincing phishing messages or impersonate company representatives, coaxing victims into revealing verification codes or account credentials. Kaspersky’s Maher Yamout adds that such data can be merged with information from prior breaches to build richer victim profiles, increasing the success of targeted scams.
Systemic Weaknesses in Loyalty Architecture
Loyalty programmes often store personal data in centralized databases that are accessed by multiple front‑end applications and third‑party partners. This layered access model creates a larger attack surface, especially when vendors integrate analytics or marketing tools without robust segmentation. When a breach occurs, the stolen information can be quickly shared on cyber‑criminal forums or private channels, sometimes within hours, as Emam observes.
UAE Personal Data Protection Law and Notification Obligations
Under the UAE Personal Data Protection Law, organisations must inform affected individuals when personal data is compromised. Landmark’s public assessment satisfies the initial disclosure requirement, but the law also obliges the company to detail remedial steps and cooperate with regulators.
Third‑Party Vendor Risks Across Retail Tech Stacks
Retail ecosystems increasingly rely on external providers for loyalty management, analytics and cloud services. The Fireworks AI breach that impacted Uber and Notion illustrates how a single vendor’s vulnerability can cascade to client data. Similar third‑party software flaws were identified in other recent incidents, such as Frontline Education’s breach caused by a vulnerability in a partner product.
Long‑Term Identity Theft Risks for Shukran Customers
Data breach research shows that victims face an elevated risk of identity theft for years after exposure. While the Shukran breach did not include financial details, the combination of names, phone numbers and birthdays can enable account takeover attempts and fraudulent impersonation, extending the threat horizon well beyond the initial incident.
ThreatLocker CEO Danny Jenkins warns that containment does not erase the risk, as personal data may circulate among criminal groups for future attacks.
Sources
- Landmark investigates Shukran data access in UAE — The National
- Data breach
- The 2027 Congress and the Dangerous Data Breach Pileup
- Uber confirms hackers stole thousands of drivers' license information in data breach | TechCrunch
- Over 3 Million People Hit by Frontline Education Data Breach
- Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000 Patients
Photo: freestocks / Unsplash (Unsplash License)
