Landmark Group Shukran Data Breach: Customer Names, Contact Details and Dates of Birth Exposed — What UAE Shoppers Should Do
Illustrative image: a shopping mall in Dubai, UAE. Landmark Group's Shukran loyalty programme covers its retail brands across the Gulf, Asia and Africa. Image: Wikimedia Commons.
📌 Key highlights
- Confirmed breach: Landmark Group told Gulf News it found unauthorised access to some of its systems, contained it immediately and launched an investigation.
- What was exposed: names, contact details and dates of birth for "some customers" in the Shukran loyalty programme. The company has not disclosed how many members were affected.
- What is safe: debit and credit card details and passwords were not affected — Landmark says it does not store card details and passwords are protected and not stored in readable form.
- Loyalty benefits intact: Shukran points, balances and wallets are unaffected, and the app and loyalty services continue to operate normally.
- Members were warned directly: affected customers were sent WhatsApp messages late on Tuesday, 10 November, telling them to stay vigilant against suspicious calls, emails and messages.
What happened?
Landmark Group, the UAE retail conglomerate behind Centrepoint, Max Fashion, Home Centre, Babyshop, Splash, Lifestyle, Shoemart and Emax, alerted members of its Shukran loyalty programme late on Tuesday, 10 November 2026. Messages sent to affected customers' WhatsApp accounts said: "We have identified an incident involving unauthorised access to some of your personal information including your name, contact details, DOB."
In a statement to Gulf News, the company confirmed the incident: "We recently identified an incident involving unauthorised access to some of our systems. We acted immediately to contain it and launched an investigation. The relevant regulatory and law enforcement authorities have been informed." The Shukran website carries a notice with the same message, and the company says it contacted affected customers directly.
A ransomware group calling itself "n0n" has posted an online claim of a Landmark Group breach, recorded on 10 November, but Landmark has not confirmed who was behind the unauthorised access or how much data was taken — so that claim remains unverified and should not be treated as fact. What is confirmed is the company's own disclosure: unauthorised access happened, personal details of some Shukran members were involved, and the investigation is still running.
What was exposed?
The confirmed exposure is limited to identity details — but those details are exactly what fraudsters use to make scams convincing. Here is what Landmark has confirmed so far, and what it has not:
| Data | Status |
|---|---|
| Names, contact details, dates of birth | Exposed for some Shukran members — the number affected has not been disclosed |
| Debit and credit card details | Not affected — Landmark says it does not store card details on its systems |
| Passwords | Not affected — passwords are protected and not stored in readable form |
| Shukran points, balances, wallets | Not affected — loyalty benefits remain intact |
| When the access happened, how it happened, whether data was copied or misused | Not disclosed — investigation ongoing |
Shukran is Landmark Group's flagship loyalty programme, connecting millions of members across the GCC, Asia and Africa. The company has not said how many of those members were affected, when the unauthorised access occurred, or how the attackers got in — all of which matters for judging the real risk, and all of which the investigation will need to answer.
Illustrative image: inside a Dubai shopping mall. Image: Wikimedia Commons.
Why it matters for UAE & Middle East readers
This is a regional story, not a distant one. Shukran is the loyalty scheme behind the shops most UAE and Gulf households use every week — Centrepoint and Max for fashion, Home Centre for furniture, Babyshop for children, Splash and Lifestyle for everything in between. Millions of members across the Gulf, Asia and Africa have handed over exactly the details now exposed: their name, phone number, email and date of birth.
On their own, those details do not unlock a bank account. But combined with the knowledge that you shop at Landmark brands, they make phishing dramatically more effective. A scam call or WhatsApp message that greets you by name, quotes your date of birth and mentions your Shukran membership sounds like it comes from the company — and that is how identity theft and payment fraud usually start. Landmark's own warning says the same thing: be cautious of unexpected calls, emails, SMS and WhatsApp messages referring to Landmark Group, Shukran or its retail brands.
The breach also continues a bad month for the region's consumer data. Singapore has seen a run of breaches at M1, Doctor Anywhere, Singapore Airlines' booking partner Amadeus and Fullerton Health, and a Latvian telecom provider left 125 million SMS messages exposed (see our CSCTelecom SMS leak explained). Loyalty programmes are a growing target because they hold exactly the identity data fraudsters want, with weaker protection than a bank's systems.
What should you do?
✅ If you received the Shukran WhatsApp alert, assume your name, contact details and date of birth were exposed. Your money and passwords are safe according to the company, but your identity details are not. Take these steps:
- Do not share OTPs, passwords or banking details with anyone who contacts you claiming to be from Landmark Group, Shukran or one of its brands — the company will never ask for these by phone, SMS or WhatsApp.
- Be suspicious of messages that know too much: a call or text that uses your real name, date of birth or Shukran membership to ask for payment or personal details is likely using the leaked information. Hang up and contact Shukran through its official channels instead.
- Change your Shukran password as a precaution, and do not reuse it on other accounts — even though Landmark says passwords were not affected, a fresh password costs nothing.
- Watch for phishing in the coming weeks: fake delivery messages, "points expiring" warnings and prize scams mentioning Centrepoint, Max or Home Centre are the most likely follow-ups.
- Check your accounts: review recent activity on email and banking apps for anything unfamiliar, and turn on login alerts where your bank offers them.
If you did not receive an alert, Landmark says you were not among the members contacted — but the company has not disclosed the full scale, so the same caution applies to any Shukran member who gets an unexpected message referencing the programme.
FAQs
Was my data exposed in the Landmark Group Shukran breach? If you received a WhatsApp message from Shukran about the incident, the company says you should assume your information was among the records involved. If you did not receive a message, Landmark says affected members were contacted directly — but the total number affected has not been disclosed.
Is my money safe? Yes, according to Landmark Group. Debit and credit card details were not affected because the company says it does not store them, and Shukran points, balances and wallets are unaffected. Passwords were also not affected.
What should I do if someone calls claiming to be from Shukran? Do not share passwords, one-time passwords, banking information or identity documents. Landmark and Shukran will never ask for these by phone, SMS or WhatsApp. End the call and contact Shukran through its official website or app.
Who is behind the breach? Landmark Group has not said. A ransomware group has posted an unverified claim online, but the company has not confirmed the attacker, the method used, or the scale of the data taken. The investigation, and the regulators and law enforcement now involved, will determine that.
Takeaway: Landmark Group has confirmed a breach of its Shukran loyalty programme: names, contact details and dates of birth for some members, with payment details and passwords safe. The money is not the risk here — your identity is. Treat any message that knows your name and shopping habits as a possible scam until proven otherwise.
If you shop with Landmark brands, check your Shukran messages now — and read our CSCTelecom SMS leak explainer to see how a leaked phone number and a few personal details can turn into a convincing fraud.
Sources
- Gulf News — "Landmark Group Alerts Shukran Members on Data Breach, Advises Vigilance" (primary source: Landmark Group statement + customer alert, published 11 November 2026)
- Gulf Business — "Landmark Group's Shukran reports data breach: What customers should know" (Shukran website notice, published 11 November 2026)
Comments
Post a Comment