Researchers Link the Khidmah Breach to 3,079 Exposed User Records Across the UAE

HEROIC analysts flagged a data breach affecting Khidmah, a prominent facilities management and property services company based in Abu Dhabi, United Arab Emirates, on May 8, 2025. The breach exposed the personal records of 3,079 users through what appears to be a direct extraction from a backend database. The data involved includes full names, email addresses, usernames, and gender, a combination that may seem limited at first glance but carries real risk when it lands in the hands of someone with malicious intent and access to other breach datasets.

Why Targeting a UAE Facilities Management Company Creates Unique Risks

Khidmah operates in the facilities management and property solutions space, which means its user base likely includes property owners, tenants, business clients, and service staff across the UAE. Data belonging to this audience is particularily appealing to attackers who want to conduct targeted scams in a specific geographic and professional context. With full names, email addresses, and gender confirmed as exposed, criminals can craft region-specific phishing messages that reference real services the victim uses, making the deception significantly harder to spot. The Arabic-language user base also means attacks can be localized and personalized with high accuracy.

What Was Exposed in the Khidmah Breach

• Email addresses
• Usernames
• First names and last names
• Gender

No passwords were included in this breach. However, the combination of a real name, a username, and an email address is often enough for attackers to attempt account recovery flows on other platforms the victim uses.

Why This Matters for Khidmah Users

Even without passwords, this breach creates meaningful risk. Credential stuffing attacks frequently rely on email addresses paired with passwords from other leaks, and the Khidmah user list gives attackers a targeted audience to test. Account takeover is a common next step, particularly for email accounts and any service where the same email address is the primary identifier. Identity theft risks also rise when full names and genders are combined with data from other sources, allowing criminals to build fuller profiles of their targets. Affected users in the UAE should be alert to unsolicited contact and review their account security across any service linked to the exposed email.

How a Database Breach Affects a Services Company Like Khidmah

A database breach occurs when an unauthorized party gains access to a company's stored user data, typically by exploiting a vulnerability in the web application, using stolen admin credentials, or finding an improperly secured database endpoint. Once access is gained, records can be copied silently without any immediate disruption to the service. Khidmah's data appears to have been extracted in this manner and subsequently posted on an underground forum, where HEROIC's monitoring systems detected it. Service-sector companies that manage large volumes of customer and property data are frequent targets because that data is easily monetizable and often less protected than in financial or healthcare organizations.

Check If Your Information Was Exposed in the Khidmah Breach

If you have ever registered with Khidmah or used their platform for property or facilties services in the UAE, your details may be among the 3,079 records that were compromised. HEROIC provides a free breach scanner backed by a database of over 400 billion exposed records. You can search your email address in seconds to find out whether it has appeared in this incident or in any of the other thousands of breaches HEROIC tracks. Early awareness gives you the best chance to secure your accounts before someone else takes advantage of your data.