Industries

One breach. A different ending in every sector.

Follow a single stolen login from the first click to the regulator's deadline. It looks the same for two steps. Then it forks.

Follow the breach ↓Skip to your sector

It starts the same everywhere

A login that should not work, works.

A phishing email. A password reused from another site. A supplier account nobody reviewed. Attackers skip the clever exploit when a valid login is on offer.

In financial and insurance breaches, phishing opened 20% and stolen credentials 15% (Verizon 2026 Data Breach Investigations Report, sector figures).

Still the same

Then the attacker looks for whoever can do the most damage.

Someone who can approve a payment, change a record, push a release or reset every password. Every organization has these people, and attackers find them faster than the organization does.

Start by naming them. From here the story depends on what your people can touch, so it forks.

Here it forks

The login reaches something that exists only in your sector.

Same intruder. Different keys, different target.

Financial ServicesNot only administrators. Staff who release payments or settle trades, holders of API credentials and signing keys, and the help desk that can reset them. BankingNot only domain administrators. Payment operators, the staff who maintain limits and beneficiaries, and the help desk that can reset any of them. InsuranceClaims handlers who can change a payee, service staff who can change a policy, broker portal users, and the help desk that can reset any of them. Aviation & TransportationNot only domain administrators. Staff who run departure control, flight operations and terminal systems, and the supplier accounts that support them. Maritime, Ports & LogisticsNot only administrators. Planners, customs agents, dispatchers and the integrators who keep remote access to cranes, gates and vessel systems. Oil & Gas & EnergyNot only domain administrators. Control engineers, contractors with vendor access, and the jumphost accounts that bridge the office and the plant. ManufacturingNot only domain administrators. Engineers with access to line controllers, remote-support accounts used by equipment makers, and the help desk that can reset them. TelecommunicationsNot only domain administrators. Network engineers with access to routers and core systems, and vendor staff with standing remote access. Real Estate & Smart BuildingsNot only administrators. Leasing agents, finance staff who change bank details, and the integrators with remote access to the building. Healthcare & Life SciencesNot only administrators. Clinicians on shared ward workstations, vendors who maintain imaging and lab equipment, and the help desk that can reset any of them. Government & Public SectorNot only domain administrators. Contractors and administrators who work across several entities, and the help desk that can reset them. EducationNot only IT administrators. Registrar, finance and payroll staff, researchers, and accounts of adjuncts and students who have left. Technology & DigitalNot only domain administrators. Engineers who can merge code, approve releases or read production secrets, and the contractors and bots that hold the same rights. Professional ServicesPartners, assistants with shared mailboxes, finance approvers, contractors and client guests. Their access spans many matters, and exceptions to policy are common. Retail & ConsumerNot only administrators. Support agents who can reset loyalty accounts, marketing staff with customer exports, and store systems that connect to head office. Hospitality & TourismNot only administrators. Reservation and front-office staff, revenue managers, and an outsourced help desk that can reset passwords and MFA.

The cost lands

Then something stops. A business function, not a server.

What stops decides what the incident costs. Here is what it is in each sector.

Financial ServicesMoney or assets movePayment instructions, settlement files, wallet keys and customer balances. Whether one stolen identity is enough depends on how approvals and keys are controlled. BankingMoney movementPayment release, limits and beneficiaries. Whether one stolen identity is enough depends on how maker-checker rules are enforced. InsuranceA payout or policy changesA changed bank detail, a redirected claim payment, or exported policy and health records. Whether one request is enough depends on the verification step. Aviation & TransportationA service that stopsPassengers and freight pile up within hours. Whether the operation continues depends on a manual fallback that has been tested, and on public services that stay up under attack. Maritime, Ports & LogisticsThe corporate estateA destructive attack on office systems can halt a global operation without touching a ship. Oil & Gas & EnergyThe process itselfControl systems, safety systems and historians. The question is whether operators can tell a cyber problem from a process fault. ManufacturingThe line stopsRansomware on office systems can halt orders, scheduling and shipping even when the machines are untouched. TelecommunicationsSubscriber data and trafficSubscriber identity records, signaling and other organizations’ traffic. A long intrusion can sit here unseen. Real Estate & Smart BuildingsThe building itselfHeating and cooling, lifts, access control, CCTV and metering, often on old controllers with remote vendor access. Healthcare & Life SciencesCare and recordsTwo things can go wrong: care slows down, or records leave the country. Both are settled before the incident, by who may take a system offline and where the data sits. Government & Public SectorData worth watchingPopulation records, security-relevant data and policy papers. The aim may be to read quietly, not to demand a ransom. EducationRecords and researchStudent and family records, fee data, unpublished research and sponsor data, often copied well beyond the system of record. Technology & DigitalA release to customersWhat gets signed and shipped, and who can change it on the way. A bad build reaches every customer, and the data each customer holds in it. Professional ServicesClient filesWhat leaks is not only the firm’s data. It is whose data, from which matter, and whether a duty of secrecy now applies. Retail & ConsumerCard and loyalty dataWhat a script, an API or an export can read: card numbers typed at checkout, and the profiles, points and saved details behind a login. Hospitality & TourismA shutdown that costsShutting systems down protects data. It can also stop card payments, websites, digital room keys and bookings.

The rules arrive

Then a clock starts. Or the rules stay silent and a patient, a flight or a shift is the clock.

The first time rule in each sector, with its UAE rule underneath. Where no deadline exists, the card says so.

Financial Services4 hoursAfter a material cyber event, by regulatorCBUAE Operational Risk Management Regulation C 1/2026 Banking4 hoursAfter a significant event on a Critical OperationCBUAE Operational Risk Management Regulation C 1/2026 Insurance4 hoursAfter a significant event on a Critical OperationCBUAE Operational Risk Management Regulation C 1/2026 Aviation & TransportationImmediatelyAfter a cyber incident that touches aviation operationsGCAA CAR Part VII, Aviation Security Maritime, Ports & Logistics2021When cyber rules reached shippingIMO Resolution MSC.428(98) Oil & Gas & EnergyNowHow industrial teams sort vulnerabilities by urgencyUAE CIIP Policy ManufacturingOn awarenessTime facts that shape a plant incidentISO/IEC 27001:2022 Telecommunications24 hoursIf an EU network is affected: NIS2 reporting clocksUAE Telecommunications Law, Federal Decree-Law 3 of 2003 Real Estate & Smart BuildingsNo fixed clockDuties come from data law and contractNIST SP 800-82 Revision 3 Healthcare & Life Sciences24 to 48 hoursTime rules that touch a UAE health providerFederal Law No. 2 of 2019 Government & Public SectorNo set clockWhat the rules say about time, and what they do notDubai Information Security Regulation (ISR) Education1 yearReview and retention periods in the ADEK policiesADEK Digital Policy, Version 1.1 Technology & DigitalEvery breachAfter a breach that touches customer personal dataUAE PDPL (Federal Decree-Law 45 of 2021) Professional Services72 hoursAfter a personal data breach, by regimeUAE PDPL, Federal Decree-Law 45 of 2021 Retail & Consumer31 March 2024Dates and triggers for card and customer dataPCI DSS v4.0.1 Hospitality & Tourism31 Dec 2024Dates that matter for card paymentsUAE Personal Data Protection Law, Federal Decree-Law 45 of 2021

Your ending