Dubai Air Wing listed on nova ransomware leak site

• Ransomware group: nova
• Country: United Arab Emirates
• Sector: Transportation
• Announcement date: January 13, 2026

Dubai Air Wing targeted by nova ransomware group

The Dubai Air Wing has been listed on the leak site of the ransomware group known as nova. According to an announcement made on January 13, 2026, the threat actor claims to have successfully executed an attack against the organization, resulting in a data breach. While the group has published a listing, no screenshots or specific evidence were provided to support the claims at the time of the announcement.

Details of the claimed attack

The threat actor, identified as the nova group, posted the listing on January 13, 2026, which coincides with the date they claim the attack took place. The group asserts that they have obtained sensitive information belonging to the organization. However, public information regarding the specific tactics, techniques, or procedures used by the nova group remains limited, making it difficult to ascertain the exact nature of their operations.

The announcement specifically claims that the breach involves the following types of information:

• Employee information
• Financial data

It is important to note that the group has not provided any specific details regarding the total volume of data stolen or the specific number of files involved in the breach. Furthermore, no ransom demand has been publicly disclosed by the group in relation to this specific target.

About Dubai Air Wing

Dubai Air Wing is an aviation organization affiliated with the government of the United Arab Emirates. The entity provides specialized VIP flight services for the Dubai royal family and high-level government officials. Based at Dubai International Airport, the organization is responsible for managing special flight operations for these high-profile individuals.

Risk assessment and implications

The claims made by the nova group suggest a potential risk of exposing the personal data of the organization's employees. Additionally, the leakage of financial data could create secondary risks regarding the operational security and the privacy of the entity. If the claims regarding the stolen data are verified, the situation could have negative impacts on the organization's reputation and could facilitate targeted phishing attacks against the entity or its personnel.

The situation also highlights the potential for legal consequences. Depending on the nature of the leaked data, local data protection regulations may trigger formal legal processes. The current situation is assessed as an attempt by the threat actor to exert pressure on the organization through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

For organizations operating in the transportation and aviation sectors, maintaining robust cybersecurity postures is essential. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security awareness training to defend against phishing. Protecting sensitive VIP and government-related flight data is particularly critical for maintaining operational security and institutional trust.