Landmark Group has confirmed a cyber incident involving its Shukran loyalty programme. The Dubai-based retail and hospitality group said on Wednesday 11 November 2026 that it is investigating unauthorised access to some of its systems. So millions of shoppers across the UAE now want clear answers about their personal details.
In fact, the news matters because Shukran is one of the largest loyalty programmes in the region. It has 10 million members, and it covers 57 brands across eight countries. Many readers in Dubai shop at Landmark stores every week, so this story touches daily life in a direct way.
Specifically, this guide sticks to facts confirmed on 11 November 2026 by The National, Gulf News, Khaleej Times and Al Etihad. No figure, date or quote comes from any other source. Where the reports stay silent, this article says so in plain terms, and it lists every gap that Landmark has not yet closed.
What Happened to Landmark Group Shukran on 11 November 2026?
Landmark Group said on Wednesday 11 November 2026 that it is investigating a cyber incident involving unauthorised access to its Shukran loyalty programme. The group is a Dubai-based retail and hospitality conglomerate. It confirmed the incident in a public statement that day, after members had already received alerts the night before.
In short, someone gained unauthorised access to some of the systems behind Shukran. Landmark has not said when the access happened. It has not said how anyone reached the systems either. The investigation is still ongoing, so those details may follow later.
Meanwhile, the Shukran app and loyalty services continue to operate as normal. Members can still earn and use points in the usual way. But the confirmation has raised fresh questions about what was seen, and this guide answers each one with the facts that are known today.
What Information Did the Incident Involve?
Customer information involved in the incident includes names, contact details and dates of birth, for some customers. That is the full list Landmark has confirmed so far. The group has not named any other type of personal information as involved.
For example, a name on its own may seem harmless. But a name joined to contact details and a date of birth gives a scammer a useful starting point. That is why Landmark urged customers to stay alert to scam calls and messages after the incident came to light.
Still, Landmark has not said how many customers the incident affected. It has not said which countries the records came from either. So readers should not assume that the incident touched every Shukran member, and they should not assume that it touched only one country.
What Information Stayed Safe in the Incident?
The incident did not affect debit and credit card details. Landmark does not store them on its systems, so the incident never touched them. That is one clear piece of good news for shoppers.
The incident did not affect passwords either. Landmark says it protects passwords securely and does not store them in readable form. So the incident did not expose member passwords in plain text.
In particular, the incident did not affect Shukran points, balances and wallets. Members have not lost points, and their balances stand as they were. The app still works as normal, and loyalty services are running without a break.
Table 1: What the incident touched and what stayed safe
| Item | Status confirmed on 11 November 2026 |
|---|---|
| Names, contact details, dates of birth | Incident touched them, for some customers |
| Debit and credit card details | Incident did not touch them, Landmark does not store them |
| Passwords | Incident did not touch them, Landmark protects them securely |
| Shukran points, balances, wallets | Incident did not touch them, services run as normal |
| Shukran app | Running as normal |
How Did Shukran Members First Learn About the Incident?
Many members first learned about the incident from an alert late on Tuesday 10 November 2026. Gulf News reported that messages went out late on Tuesday to members through their WhatsApp accounts. Khaleej Times reported that members received an SMS alert instead.
In other words, the first warning reached members directly, before the public confirmation on Wednesday. Khaleej Times added a clear point for readers who got the message. Members who received an SMS alert should assume the incident touched their information.
At the same time, members who got no alert should not jump to a firm conclusion. Landmark has not said that the incident touched only alerted members. It has not said that the incident touched every member either. So the safest course is to stay alert, whether or not a message arrived.
What Did Landmark Group Say in Its Statement?
Landmark Group issued a statement through Gulf News on Wednesday 11 November 2026. It said, in full: “We recently identified an incident involving unauthorised access to some of our systems. We acted immediately to contain it and launched an investigation. The relevant regulatory and law enforcement authorities have been informed.” This article quotes it exactly as Gulf News published it.
In brief, the statement covers three points. First, the group found the incident itself. Next, it acted at once to contain it and started an investigation. Finally, it informed the relevant regulatory and law enforcement authorities.
Meanwhile, Landmark also spoke to The National the same day. It said: “We have also informed the relevant statutory and law enforcement authorities and are actively investigating the matter.” This article quotes it exactly as The National published it.
What Did the Alert Message to Members Say?
The alert that reached members late on Tuesday 10 November 2026 was short and direct. Gulf News published the wording of the message. It said: “We have identified an incident involving unauthorised access to some of your personal information including your name, contact details, DOB”. This article quotes it exactly as Gulf News published it.
Specifically, the message named the same three types of information that Landmark later confirmed in public. It listed name, contact details and date of birth. It did not name card details, passwords or points, and Landmark later confirmed that the incident left those items untouched.
In general, a short alert like this one aims to warn members fast. It does not give the full picture, and it does not answer every question. The fuller picture came the next day, when Landmark confirmed the incident in public on Wednesday 11 November 2026.
What Is Shukran and How Big Is the Programme?
Shukran is the flagship loyalty programme of Landmark Group. Al Etihad reported that it has 10 million members. It covers 57 brands and over a million products across eight countries. That scale makes it one of the largest retail loyalty programmes in the region.
For example, members earn points when they shop at Landmark brands, and they can then use those points on later visits. The programme runs through the Shukran app, which also holds member balances and wallets. The incident did not affect those balances.
Overall, the size of Shukran explains why this story drew wide coverage on 11 November 2026. A programme with 10 million members touches a large share of shoppers in the UAE and beyond. So even a limited incident can affect a large number of people.
Which Landmark Brands Use Shukran?
The National named several Landmark brands in its report on 11 November 2026. They include Max, Splash, Centrepoint, Emax, Home Centre, Fitness First and Viva supermarket. These are familiar names on high streets and in malls across Dubai.
In particular, the group also runs Babyshop, Lifestyle and Shoemart. Those brands sit alongside the names above in the Landmark portfolio. Shoppers in Dubai will know many of them from regular visits to malls across the city.
Meanwhile, shopping is a large part of daily life in Dubai, and the things to do in Dubai include long visits to malls and retail districts. Our Dubai areas guide covers the districts where these stores trade. If you are planning a shopping trip, our guide to the best time to visit Dubai can help you pick your dates.
What Has Landmark Done Since Finding the Incident?
Landmark says it acted immediately to contain the incident and secure the affected system. That action came as soon as the group identified the unauthorised access. The statement does not give a time for the containment work, so this article gives none either.
Next, the group launched an investigation, and that investigation is still ongoing. It has also informed the relevant statutory and law enforcement authorities. The National and Gulf News both reported that step on 11 November 2026.
At the same time, Landmark contacted affected customers directly. Alerts went out late on Tuesday 10 November 2026, before the public confirmation on Wednesday. The group has also pointed members to more details at shukran.com/qa, as Khaleej Times reported.
Table 2: Timeline of the Shukran incident so far
| Date | What happened |
|---|---|
| Late Tuesday 10 November 2026 | Alerts sent directly to affected Shukran members |
| Wednesday 11 November 2026 | Landmark confirmed the incident in public |
| Wednesday 11 November 2026 | Authorities informed, investigation ongoing |
| Thursday 12 November 2026 | This guide published with the confirmed facts |
What Do We Still Not Know About the Breach?
Several key facts still lack a public answer, and this article will not fill them in. Landmark has not disclosed how many customers the incident affected. It has not said when the unauthorised access happened. Those two gaps sit at the centre of the story.
In particular, the group has not said how anyone reached the systems. It has not said whether anyone copied or misused any information. It has not said which countries the records came from. Each of these points is still open, and readers should watch for updates.
Still, the gaps do not change the confirmed facts. The incident involved names, contact details and dates of birth for some customers. The incident did not affect card details, passwords or points. That split is clear, even while the wider picture stays incomplete.
Why Does the Number of Affected Members Matter?
The number of affected members leaves the biggest gap in this story. Shukran has 10 million members, so the gap between a small group and a large group is wide. Until Landmark gives a figure, nobody can say how many people the incident involves.
For example, a small number would still matter to the people in it. A large number would matter to far more shoppers, and it would raise bigger questions about the scale of the incident. But nobody can judge either case today, because Landmark has not disclosed the figure.
Meanwhile, readers should be careful with numbers they see online. Any figure that does not come from Landmark or an official source is only a guess. This article gives no number, because no confirmed number exists as of Thursday 12 November 2026.
What Should Shukran Members Do Right Now?
First, read the alert again if you received one late on Tuesday 10 November 2026. Khaleej Times says members who received an SMS alert should assume the incident touched their information. That is the clearest guide Landmark has given so far.
Next, stay alert to scam calls and messages, as Landmark urged. A scammer may use your name and date of birth to sound convincing. So treat any unexpected call about Shukran with care, even if the caller knows some of your details.
Finally, check the official update page at shukran.com/qa for more details. That page is the source Khaleej Times pointed readers to on 11 November 2026. If you are travelling soon, our UAE flight updates track the latest changes to flights from the UAE.
How Can Shoppers Spot a Scam Call or Message?
As a general rule, a scam message often creates urgency. It may say your account will close, your points will vanish, or a payment is due at once. But Landmark has confirmed that the incident left Shukran points, balances and wallets untouched, and the app still works as normal.
In particular, watch for messages that ask you to click a link or download a file. As a general rule, links in unexpected messages deserve extra care. A safer course is to open the official app yourself, or to type the official web address yourself, rather than tapping a link in a message.
Also watch for poor spelling, odd sender names and requests that feel out of place. As a general rule, a genuine message from a large retailer will not ask you to share a password or a bank code. If a message does ask for that, treat it as a warning sign and stop. Official portals are the safe way to check official matters, and you can check an RTA fine by plate number online through the official route.
What Should You Never Share With a Caller?
As a general rule, never share a password with a caller, even if the caller sounds official. Landmark has confirmed that the incident left passwords untouched, and it protects them securely. No genuine caller needs your password to help you.
Similarly, never share a one-time code, a bank PIN or full card details with a caller. Landmark does not store debit and credit card details on its systems, so it has no reason to ask you for them now. A caller who asks for those details is not following a normal process.
Also, be careful with personal details in general. A caller who already knows your name and date of birth may still be a stranger. As a general rule, that knowledge alone does not prove that the caller works for Landmark or for any official body.
How Can You Check Your Shukran Points and Balance?
Landmark has confirmed that the incident left Shukran points, balances and wallets untouched. The Shukran app and loyalty services continue to operate as normal. So members can check their balance in the app in the usual way, and they should see the same balance as before.
For example, if your balance looks wrong, do not panic at once. Instead, check it again after a short time, and look at your recent activity in the app. A small display delay is not proof of a problem, and Landmark has said the incident left the points themselves untouched.
Meanwhile, loyalty cards are a familiar part of daily life in Dubai. The Dubai nol Jaywan card works in a similar way for transport, with a balance that riders can check and top up. The habit is the same in both cases: check the balance through the official channel, and keep your details private.
Why Are Loyalty Programmes a Target for Attackers?
Loyalty programmes hold a large amount of personal information in one place. A programme with 10 million members holds names, contact details and dates of birth at a scale that few other systems match. That scale alone makes such programmes a useful target.
In particular, loyalty data can help a scammer sound convincing. A name joined to a date of birth and a phone number can open a conversation that feels real. So the risk after an incident like this one is often a wave of scam calls, rather than a direct loss from the programme itself.
Overall, the lesson for shoppers is a simple one. A loyalty account deserves the same care as any other account that holds personal details. Keep passwords private, watch for odd messages, and use the official app for any check or change.
What Does a Data Breach Cost in the Middle East?
The National cited IBM latest report on the cost of data breaches. The report says the average cost of a data breach for Middle Eastern organisations reached 8 million dollars this year. That figure covers the region as a whole, and it is not a figure for Landmark Group.
Specifically, the 8 million dollar figure is an average, not a bill for one company. Some incidents cost far less, while others cost far more. But the average shows that a breach is an expensive event for any large organisation in the region.
In short, the cost figure helps readers see why companies act fast when they find an incident. Landmark says it acted immediately to contain the incident and secure the affected system. That speed is a normal part of the response, and it matches the scale of the risk.
How Big Is the Loyalty Market in the Middle East?
Khaleej Times cited figures from ResearchAndMarkets.com on the loyalty market. ResearchAndMarkets.com forecasts the Middle East loyalty market to grow from 3.4 billion dollars in 2026 to 5.6 billion dollars by 2030. That growth works out at a compound annual growth rate of 12.8 percent.
In particular, the forecast puts the UAE market at 592.4 million dollars. That figure shows how large loyalty schemes have become in this country. Shukran, with 10 million members and 57 brands, sits at the centre of that market.
Meanwhile, the growth forecast also explains why loyalty data matters so much. More members and more brands mean more personal information in one place. So the care that companies take with that information will matter more with each passing year.
Where Can You Find More Details About the Incident?
Landmark has pointed members to more details at shukran.com/qa. Khaleej Times reported that link on 11 November 2026. That page is the official source for updates from Landmark itself, and it is the best place to check as the investigation moves on.
Also, the four reports used for this guide remain the public record so far. The National reported the incident at 12:47 on 11 November 2026. Gulf News followed at 14:27 the same day. Al Etihad reported it at 15:42, and Khaleej Times at 17:57.
Finally, readers should watch for new statements from Landmark and from the authorities it informed. The investigation is ongoing, so new facts may appear in the coming days. This guide will add each fact as Landmark confirms it, and it will not guess at the gaps.
What Happens Next for Landmark and Shukran?
From now on, the next step belongs to Landmark and its investigation team. The group is still investigating the incident, and it has informed the relevant statutory and law enforcement authorities. New details should follow as the investigation finds them.
Next, readers should watch for five answers in particular. First, how many customers the incident affected. Then, when the unauthorised access happened. After that, how anyone reached the systems, whether anyone copied or misused any information, and which countries the records came from.
Finally, life in Dubai goes on while the investigation runs. The new UAE traffic rules for 2027 will change road travel in the months ahead, so drivers should read those too. For now, Shukran members should stay alert, check the official update page, and use the app as normal.
Frequently Asked Questions?
Did the Shukran Breach Touch My Card Information?
No, the incident did not affect debit and credit card details. Landmark does not store them on its systems, so the incident never touched them. The incident involved names, contact details and dates of birth, for some customers.
Are my Shukran points still safe?
Yes, the incident left Shukran points, balances and wallets untouched. The Shukran app and loyalty services continue to operate as normal. Members can check their balance in the app in the usual way.
How Do I Know If the Incident Touched My Details?
Khaleej Times says members who received an SMS alert should assume the incident touched their information. Alerts went out late on Tuesday 10 November 2026. Landmark has not said how many customers the incident affected, or which countries the records came from.
What should I do if I get a suspicious call about Shukran?
As a general rule, do not share a password, a one-time code, a bank PIN or full card details with a caller. Landmark urged customers to stay alert to scam calls and messages. Check the official update page at shukran.com/qa, and use the official app for any check.
When did Landmark confirm the incident?
Landmark confirmed the incident in public on Wednesday 11 November 2026. Alerts had already gone out to affected members late on Tuesday 10 November 2026. This guide was written on Thursday 12 November 2026 with the facts confirmed on 11 November 2026.
Where can I read the official update?
Landmark has pointed members to more details at shukran.com/qa. That page is the official source for updates from Landmark itself. The investigation is ongoing, and this guide will add new facts as Landmark confirms them.
