Arabia Falcon Insurance Says Hacked Data Appears Published

On 7 July, Arabia Falcon Insurance told the Muscat Stock Exchange (MSX) that it had suffered no data breach. On 16 July it said online claims of a cyberattack looked credible. In a new filing on 12 October, the listed Omani insurer went further: it said it had "recently become aware that data appears to have been published." That brings the incident from a contained intrusion attempt to probable data exposure, and it is one of the clearest public tests yet of how listed Omani companies disclose cyber incidents under the country's tougher data protection rules.

🔑 Key Takeaways

• Arabia Falcon Insurance (MSX: AFIC) filed a third update on its June cyber incident on 12 October 2026. The filing appears on the company's MSX announcements list, and its contents were reported by Oman Observer.
• The insurer said data "appears to have been published". It is still working out what data was affected.
• The company said it has no evidence of any impact on financial data and no evidence that customers have been harmed, according to Oman Observer.
• The ransomware group TheGentlemen claimed the attack on 6 July and threatened to leak data unless the company negotiated, according to threat-intelligence tracker DeXpose. The company has not publicly named any group.
• Oman's Personal Data Protection Law gives controllers 72 hours to report qualifying breaches to the regulator. Penalties under that law were raised by Royal Decree 68/2026 in September.

📄 What the 12 October Filing Says

The new disclosure follows two earlier notices, dated 7 July and 16 July 2026. That sequence is visible in the filing's title on the MSX announcements list compiled by Mubasher. As Oman Observer reported, the insurer said it has continued its investigation with external legal counsel and specialist digital forensic experts. It also said operations have continued without disruption.

The company has not said what kind of data was published, how many records it covers, or whether personal information about policyholders is included. It says it is still trying to "understand what data may have been affected". It added that it currently has no evidence of any impact on financial data or of any detriment to customers, Oman Observer noted.

🕒 How the Story Has Shifted Since June

The company's public position has changed considerably over three and a half months:

In its July update, the insurer said its 24/7 endpoint detection and response tools had seen no further suspicious activity after containment, The Arabian Stories reported. The new filing does not dispute that. Instead, it shifts the question from whether attackers got in to what they took and released.

⚖️ The Data Protection Angle

Insurers handle sensitive material such as identity documents, medical details for health cover, and vehicle and claims records. That puts any confirmed exposure squarely within Oman's Personal Data Protection Law (PDPL). Under the law's executive regulations, controllers must report a breach to the Ministry of Transport, Communications and Information Technology (MTCIT) within 72 hours of learning about it. They must also notify affected individuals within the same window where the breach could cause serious harm or high risk, according to a Trowers & Hamlins briefing on the regulations.

The public filings do not say whether Arabia Falcon has notified MTCIT or any individuals. Because the company has not yet said personal data was involved, it is too early to say which obligations apply.

The rules have also become stricter. Royal Decree 68/2026 amended the PDPL with effect from 7 September 2026. According to CMS, it raised fines for some violations to as much as OMR 10,000 and expanded MTCIT's role as regulator. Baker McKenzie also notes that the amendments widen the law's territorial scope. Regulators have already started publishing enforcement data, as our earlier look at MTCIT's first breach and complaint figures showed.

🛡️ Part of a Wider Pattern

Arabia Falcon is not an isolated case. In September we reported on a ransomware gang's claim against Asyad, which also cited earlier claims against Omani firms this year. Oman's response at national level is the National Cybersecurity Strategy 2026-2030. Prepared by the Cyber Defence Centre, it rests on five pillars covering governance, resilience, capacity building, cooperation and the cyber economy, Muscat Daily reported.

👥 What policyholders can do now

• Watch for official messages from the insurer, and check any request to "verify" policy or payment details through known channels before acting.
• Treat unexpected calls, emails or WhatsApp messages that quote your policy details with extra suspicion. Leaked insurance data is a common basis for convincing phishing.
• Keep an eye on bank and card activity, even though the company says it has no evidence that financial data was affected.

🇴🇲 Why this matters for Oman

Under Vision 2040, more insurance, banking and government services are moving online. Public trust depends on companies being clear and timely about incidents when they happen. The Arabia Falcon filings show what disclosure looks like in practice in Oman: an initial denial, a correction nine days later, and confirmation of probable publication about three months after that. It will matter what comes next. That includes whether the company identifies the data involved, whether affected people are told, and how MTCIT uses its newly expanded PDPL powers. Together, those answers will show whether Oman's upgraded data law changes how listed companies handle breaches, or only how much a breach costs them.