19 July 2024
Critical — Global
CrowdStrike / Microsoft Falcon Outage
A faulty content update to CrowdStrike's Falcon sensor caused mass Windows blue-screen-of-death events globally. In the UAE, the Ministry of Foreign Affairs (MoFA) took its portals offline, instructing the public to make no online transactions. MOHRE (work permits) reported "difficulties." Dubai Airport recorded disruptions. Emirates, Flydubai and Etihad all issued alerts. Authentication services were among the first casualties — a stark reminder that security tooling itself is an operational dependency.
Government Portals
Airports
Airlines
Authentication
HR Services
BCM Lesson: Third-party security software is a critical dependency. Single-vendor endpoint protection without rollback controls is a systemic vulnerability — not a security asset.
8 February 2025
Major — Dubai
Du Network Outage — Dubai
Du, one of the UAE's two main telecoms providers, reported a network outage affecting home broadband and mobile services across Dubai. DownDetector recorded 213 affected customers within 90 minutes, predominantly home internet and mobile signal. Etisalat (e&) customers also reported disruption simultaneously. Residents who remained connected were those who could switch to an alternative network — a privilege of dual-SIM capability, not a managed BCM strategy.
Broadband
Mobile Services
Streaming
Remote Working
BCM Lesson: Single-carrier internet dependency is a BCM failure for any critical service operation. Diverse connectivity (dual-carrier, satellite backup, alternative routing) must be part of resilience architecture.
March 2025
Major — UAE Banking
UAE Banking App Outages — Cloud Disruption
Emirates NBD, Emirates Islamic, First Abu Dhabi Bank and ADCB all experienced disruptions to digital banking services. ADCB's retail mobile banking app was down for approximately 48 hours — though branches, ATMs, card services and internet banking remained operational. The incident demonstrated both the fragility of cloud-hosted app layers and the importance of channel diversification in BCM planning. Critically, multiple banks issued fraud warnings simultaneously — opportunistic attackers exploited the confusion to impersonate official channels.
Mobile Banking
Contact Centres
Cloud Platforms
Customer Trust
BCM Lesson: Cloud-hosted services require dedicated resilience architecture — not just cloud availability SLAs. Channel diversification (branch, ATM, web, app) is a BCM essential for financial services, not a UX preference.
June 2025 — March 2026
Critical — Active Conflict
Iran–Israel War: Coordinated APT & Hacktivist Campaign Against UAE
Following Israeli military strikes on Iran beginning 13 June 2025, the Islamic Resilience Cyber Axis — a coordinated network of Iranian state-backed and affiliated groups — launched one of the most sustained cyber campaigns against Gulf targets in history. Iranian APT groups including APT33, APT34 (OilRig), MuddyWater, and Pioneer Kitten ran concurrent DDoS, ransomware (Pay2Key.I2P), wiper, espionage and credential-theft operations targeting UAE government, financial services, energy, and critical infrastructure. The UAE Cyber Security Council reported that government and financial sector targets faced daily sophisticated and AI-enhanced attacks between 21–26 February 2026 — which national authorities stated were "systematically detected and foiled." The operative word is "this time."
UAE Financial Services
Government Systems
Energy Sector
Critical Infrastructure
APT33 · OilRig
BCM Lesson: Iranian APT groups have maintained persistent footholds in UAE critical infrastructure via credential theft and VPN compromise since early 2025. Assumed breach posture — not perimeter defence — is the only credible response. Wiper malware is the weapon of choice in conflict-adjacent operations; offline, air-gapped backups are no longer optional.
1 March 2026
Critical — Kinetic + Digital
Iranian Drone Strikes Destroy AWS Data Centres — UAE & Bahrain
In a historic first, Iranian drone strikes physically destroyed three Amazon Web Services data centre facilities in the UAE and Bahrain — causing fires, power disruptions, water damage from fire suppression, and prolonged service outages. The strikes came within 24 hours of Operation Epic Fury (Operation Roaring Lion), the coordinated US-Israel strikes on Iranian targets launched 28 February 2026. The AWS incidents disrupted digital services across the Gulf including banking providers, payment services and consumer apps. AWS subsequently advised customers with Middle East workloads to migrate to alternative regions. Snowflake, Red Hat and other SaaS vendors issued failover advisories. Nvidia temporarily closed its Dubai offices. The incident demonstrated that physical distance from a conflict zone provides no insulation from kinetic impacts on shared cloud infrastructure.
AWS UAE Region
Banking Services
Payment Platforms
SaaS Vendors
Enterprise Tools
BCM Lesson: Cloud DR plans built around single-zone or regional failover are insufficient when the region itself is a military target. Firms must test full-region cloud outage scenarios, maintain offline-accessible emergency plans, and validate that DR workloads can genuinely run in geographically separate regions with no Middle East dependency.
February–March 2026
Major — Electronic Warfare
GPS Spoofing — 1,100+ Ships Across Gulf Waters
Electronic warfare operations attributed to the Iran–Israel conflict disrupted GPS and Automatic Identification System (AIS) signals for more than 1,100 vessels across UAE, Qatari and Omani territorial waters. CSIS analysts noted the interference was consistent with the electronic operations pattern accompanying the broader conflict. For UAE-based firms, the spoofing directly impacted maritime logistics, physical security systems dependent on GPS timing, and supply chain operations — with implications for financial services firms processing trade finance and commodity transactions reliant on vessel tracking data.
Maritime Logistics
GPS-Dependent Systems
AIS Tracking
Trade Finance
Supply Chains
BCM Lesson: GPS-dependent systems — including timing infrastructure, physical security, logistics platforms and some financial transaction systems — require spoofing-resilient alternatives. Firms processing trade finance or commodity transactions should review their data-source dependencies for vessel tracking and origin verification.
2024–2026 Ongoing
Ongoing — Escalating
DDoS Surge — Geopolitical Weaponisation
The UAE Cyber Security Council's 2025 report confirmed 373,429 DDoS incidents in 2024 — an 862% increase since 2019. The Iran–Israel conflict has further accelerated this trend, with hacktivist groups on both sides using DDoS as their primary low-cost, high-visibility weapon against Gulf financial and government infrastructure. Average attack duration in H1 2025 exceeded 27 minutes — long enough to trigger CBUAE Article 149 breach notification obligations and cause material customer impact to digital banking services.
Financial Services
Government
Telecoms
Critical Infrastructure
BCM Lesson: DDoS mitigation must be built into resilience architecture. Pre-contracted scrubbing, tested traffic rerouting, and customer communications playbooks are standard requirements for any UAE financial services firm. The 27-minute average attack duration is long enough to require regulatory notification.
