UAE Telecom Sector Hit: The SGEM Breach Exposed 3,852 Customer Records

HEROIC analysts identified a database breach affecting Special German Electro-Mechanical L.L.C. (SGEM), a UAE-based company operating in the telecommunications and electro-mechanical services sector. The breach was flagged on January 26, 2025, with the underlying compromise believed to have occurred in January 2025. The exposed dataset contained 3,852 confirmed records, each including full names, email addresses, and phone numbers belonging to customers or contacts associated with the organization.

Why Telecommunications Sector Breaches Put Customers at Serious Risk

Companies in the telecom and technical services space hold a particularly sensitive type of customer data. Phone numbers combined with full names and email addresses create a complete contact profile that enables a range of targeted attacks. In the UAE context, where mobile numbers are often tied to government services, banking applications, and two-factor authentication, this combination of data is especially dangerous. An attacker with a verified phone number and email address can attempt SIM swap fraud, targeted phishing, and account recovery attacks across any platform that uses phone-based verification.

What Was Exposed in the SGEM Data Breach

• First names and last names — enabling personalized social engineering and spear-phishing attempts
• Email addresses — direct contact points for phishing campaigns impersonating SGEM or related organizations
• Phone numbers — opening the door to SIM swap attacks, SMS phishing (smishing), and two-factor authentication bypass

Why This Matters for Identity Theft and Fraud

No passwords were included in this breach, but that does not significantly reduce the risk. The combination of full name, phone number, and email address is sufficient to impersonate a victim to customer support teams, initiate account recovery processes, and conduct highly targeted phishing attacks. In the UAE, where digital banking and government e-services are widely used, fraudsters can leverage a verified phone number to bypass SMS-based two-factor authentication on financial accounts. The personal nature of this data also makes it suitable for identity fraud in contexts requiring identity verification.

How Database Breaches at Technical Services Firms Occur

Electro-mechanical and technical services companies often maintain customer and project databases containing contact records, proposal histories, and procurement data. These systems are not always subject to the same rigorous security standards as financial institutions or large consumer platforms. Attackers exploit vulnerabilities in web-facing admin panels, outdated database software, or improperly secured cloud storage buckets to extract customer data. The SGEM breach appears to follow this pattern: a database containing business contact and customer records was accessed and subsequently leaked on a dark web forum.

Check If You Are Affected by the SGEM Breach

If you are a customer, contact, or employee of SGEM, your email address may have appeared in this breach. HEROIC's free breach scanner searches more than 400 billion leaked records, including database dumps from companies across the Middle East and UAE. Visit heroic.com to run a free check. If your email or phone number is confirmed in this leak, be especially vigilant about unexpected calls, text messages, or emails claiming to be from SGEM or related organizations.