Skip to content
Leak-site post naming Al-Futtaim Group, captured by ThreatCluster
Back to victims

Al-Futtaim Group

everest

Ransomware leak-site victim intelligence · EN

Data size
307 GB
Files
161,149
Views
65,000
Posted
Jul 21, 2026
Countdown
The files will be published after the timer counts down.
Country
AE
Industry
Retail & E-Commerce

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom note

Threat actors claim to have stolen 307 GB across 161,149 files from Al-Futtaim Group, and the archive is published on the group’s leak site. They state the data covers corporate IT materials, finance and HR documents, and automotive-related files, with OneDrive exports also included. The leak notes sub-sections such as NEW Materials, RPA Automation - Automotive, and AC Project Team, and references AFM Bodyshop Claims among the data. The leak post is published, with latest post date Aug 6.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
Automation Anywhere ServiceMax SAP ITSM OneDrive Azure MCAS

What was taken

The Al-Futtaim archive contains 161,149 files totaling 307 GB.

Data categories
Business and Operational CoverageMain Data AreasOneDrive Exports and Automation PackagesCMC Finance, Business Process and Automotive OperationsRoot-Level Corporate ArchivesRPA Automation - AutomotiveAC Project Team, Construction and Engineering DocumentationNEW MaterialsAFM Bodyshop Claims Documentspolicy documentsSOPsprocess mapstraining manualsServiceMax documentationSAP automation metadataOneDrive exportsautomation packagesbot repositoriescorporate IT materialsknowledge-management contentemployee-services trainingtreasury and finance documentationbuilding-system drawingsconstruction-project documentationMEP drawingsCAD filesproject submissionsNEW policy / intranet / retail / PMO materials and operational datasetspolicy documentsSOPsprocess mapstraining manualsinsurance and registration recordsaudit recordsVAT recordscustoms recordsinternal communication contentintranet materialsproject-management materialsoperational reporting
File types seen
db × 93js × 3,772bak × 196css × 361csv × 6,363dwf × 328dwg × 1,811gif × 3,470htm × 431jar × 2,089jpg × 19,497mp3 × 107mp4 × 456msg × 1,996pdf × 50,615png × 29,815txt × 17,774xls × 1,662xml × 99aspx × 388docx × 908jpeg × 2,430json × 261xlsm × 84xlsx × 11,929

Ransom note

Published by the group on their leak site, reproduced verbatim.

The files will be published after the timer counts down. The company still has time to get in touch with us

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

label
The files will be published after the timer counts down. The company still has time to get in touch with us
value
4p2hmbuy36oau64fcvwz2yvdw7eptlkionm46p2m2cs6dmhone5mxiyd.onion
Onion link
4p2hmbuy36oau64fcvwz2yvdw7eptlkionm46p2m2cs6dmhone5mxiyd.onion
NEW Materials
The NEW section contains 5,450 files totaling 14 GB.
RPA Automotive
The RPA Automation - Automotive folder contains 31,073 files totaling 53 GB.
AC Project Team
The AC Project Team section contains 8,191 files totaling 37 GB.
Main data areas
The main data areas are distributed across corporate IT materials, knowledge-management content, employee-services training, ServiceMax documentation, treasury and finance documentation, automotive RPA automation, OneDrive exports, CMC finance and business-process documentation, bodyshop claims files, construction-project documentation, MEP drawings, CAD files, building-system drawings, project submissions, NEW policy / intranet / retail / PMO materials and operational datasets.
Latest post date
Aug 6
OneDrive exports
28,849 files totaling 81 GB.
Archive structure
15,665 filesystem files, 5,783 folders and 922 archive containers.
AFM Bodyshop Claims
The AFM Bodyshop Claims Documents folder contains 21,288 files totaling 6 GB.

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page11 KB
Logo of Keysight Technologies featuring a red waveform graphic and the company name in white text.
onion leak page128 KB
onion leak page11 KB
Logo featuring the text "mansfield" in a stylized font, with "FAMILY DENTISTRY" below it.
onion leak page1.4 KB
Logo featuring a stylized letter "P" in orange with a black play button icon integrated into the design.
onion leak page7.5 KB
onion leak page5.8 KB
Logo featuring the text "Al-Futtaim" in blue, with "automotive" in a smaller font below it, accompanied by a geometric symbol.
onion leak page5.6 KB
The image features a logo with stylized figures in orange and blue, representing people, alongside the text "ALZONE" in a bold, blue font.
onion leak page7.0 KB
Logo of Emirates Flight Catering, featuring stylized text in gold and red.
onion leak page6.8 KB
Logo of Dharma Group featuring a stylized design with blue and green colors, accompanied by the text "DHARMA GROUP" below it.
onion leak page7.7 KB

Negotiation
Onion 4p2hmbuy36oau64fcvwz2yvdw7eptlkionm46p2m2cs6dmhone5mxiyd.onion