Dubai-based retail conglomerate Landmark Group has confirmed a data breach affecting members of Shukran, its loyalty programme, after an unauthorised party accessed customer names, contact details and dates of birth.
Affected members began receiving alerts late on Tuesday, November 10, 2026. Messages sent through WhatsApp and SMS warned that the incident involved “unauthorised access to some of your personal information including your name, contact details, DOB,” and urged customers to watch for suspicious calls, emails and messages.
What Landmark Group has confirmed
In a Q&A published on the Shukran website, the company said it “recently identified an incident involving unauthorised access to one of our systems” and “acted immediately to contain it.” It said the relevant statutory and law enforcement authorities have been informed and that its investigation is ongoing.
According to the notice, the information involved includes:
- Names
- Contact details
- Dates of birth
Shukran said members who received an SMS about the incident should assume their information is among the records involved.
The company said debit and credit card details were not affected because it does not store them on its systems. It also said passwords were not affected because they are “securely protected” and “not stored in readable form.” Shukran points, balances and wallets were not impacted, and the Shukran app and loyalty services continue to operate as normal.
Landmark Group confirmed the incident in a statement to Gulf News, repeating that it had contained the unauthorised access and launched an investigation.
What has not been disclosed
Landmark Group has not said how many Shukran members were affected, which countries they are in, when the unauthorised access took place or how the attacker got into its systems. It has also not said whether the data was copied or misused.
The scale could be significant. Landmark Group’s website lists more than 14 million active shoppers across the GCC in its loyalty section. Shukran is used across the group’s retail brands, including Centrepoint, Max, Home Centre, Babyshop, Splash, Lifestyle, Shoemart and Emax. The group operates in the UAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt and Jordan, as well as India and Southeast Asia. That membership figure is not a count of affected customers, and the company has not linked the incident to any specific market.
N0n extortion group lists Landmark Group
Around the same time, the N0n extortion group added Landmark Group to its data leak site. The listing, which appeared on November 10, 2026, allegedly includes 28.7 GB of data. The group claims it took storefront account data covering 8 of the retailer’s online storefronts, a search index, about 3.3 million product catalog rows and 315,042 shopper search queries. The post marks Landmark Group as a victim that did not pay.
These claims have not been independently verified, and the data the group describes does not clearly match the categories Landmark Group has confirmed. Landmark Group had not issued any public statement about the N0n claim at time of publication, and it has not said whether the two are connected.
Phishing risk for Shukran members
Names, contact details and dates of birth are exactly what scammers need to make fake messages look convincing. Shukran warned members to be cautious of unexpected calls, emails, SMS or WhatsApp messages that mention Landmark Group, Shukran or any of its retail brands. The company’s advice includes:
- Never share passwords, one-time passcodes (OTPs), banking details or ID documents with anyone who contacts you by phone, email, SMS or WhatsApp.
- Be wary of messages that create urgency, include unexpected links or attachments, or offer unsolicited refunds, prizes or bonus points.
- Use a strong, unique password for your Shukran account and do not reuse it on other sites.
Shukran said it will only ask for OTPs over the counter in a store or inside the Shukran app. Members with questions can email customersupport@shukran.com.
If a message about this incident looks suspicious, our guide on how to check a suspicious email safely walks through what to look for, and our guide on how to respond when you receive a data breach notification explains the next steps.
Recent retail data breaches
Retailers and their loyalty programmes hold large amounts of customer contact and identity data, which makes them a frequent target. Recent cases include the Muji Card data breach in Japan, the Nitori breach involving up to 37 million customer records and the Chick-fil-A loyalty account breach.
BreachNews will update this story if Landmark Group shares the number of affected members, the markets involved or details on how its systems were accessed.
