THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

UAE E-commerce Site noonsugar.com Listed by M3RX Ransomware Group

noonsugar.com, a retail and e-commerce platform based in the United Arab Emirates, has been recorded on the M3RX ransomware group's public tracker. The listing was made on September 29, 2026. The organization has not publicly disclosed a breach as of this report. A listing on an attacker-side tracker is strong signal that data may have been exfiltrated, but it is not a confirmed breach on its own.

Key takeaways

• noonsugar.com was recorded on the M3RX ransomware tracker on September 29, 2026
• The organization is a mid-sized UAE e-commerce platform with 51 to 100 employees
• No public disclosure of a breach has been made by the organization
• A tracker listing is strong signal but not a confirmed breach

What We Know

• Organization: noonsugar.com
• Domain: noonsugar.com
• Country: United Arab Emirates
• Sector: Retail / E-commerce
• Company size: 51-100 employees
• Ransomware group: M3RX
• Listing date: September 29, 2026
• Disclosure status: Not disclosed yet

About the Ransomware Group

M3RX is a ransomware operation that maintains a public leak site where it lists victims. The group publishes organization names and domains, sometimes alongside data samples or countdown timers. Listings on such trackers are used as pressure tactics to encourage victims to pay ransoms. The group's operational details, including its infrastructure and attribution, remain limited in public reporting.

What a Listing Means

A ransomware listing is a strong indicator that an organization may have been targeted. However, it does not confirm that a breach occurred or that data was stolen. In some cases, listings are used as intimidation tactics against organizations that have not been compromised. In other cases, they reflect genuine data theft where the victim has refused to pay. Without a public disclosure from the organization itself, the true status remains uncertain.

Context for the Sector

The retail and e-commerce sector is a frequent target for ransomware groups. These businesses often handle customer payment data, order histories, and personal information. A mid-sized operation with 51 to 100 employees may have limited dedicated security staff, making it a more attractive target for groups seeking quick results. The United Arab Emirates has seen a growing number of ransomware listings in recent years, spanning multiple sectors including retail, logistics, and technology.

Recommended Actions

If your organization is listed on a ransomware tracker, consider the following steps:

• Verify the listing independently. Check whether data samples match your records.
• Review your incident response plan and activate it if warranted.
• Engage legal counsel and notify relevant data protection authorities if required by local law.
• Communicate with customers and partners if a breach is confirmed.
• Do not pay the ransom without professional guidance. Payment does not guarantee data deletion.

Intel128 Assessment

The listing of noonsugar.com by M3RX warrants attention but does not constitute proof of compromise. Intel128 will continue to monitor this entry for updates, including any data samples published by the group or any public statements from the organization. We recommend that security teams in the UAE retail sector review their exposure to M3RX and similar groups as a precaution.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.