Landmark Group · Breach

[Single source] n0n extortion group lists UAE retail giant Landmark Group

Nov 09, 2026 · 1 min read

The n0n extortion group added Landmark Group, the Dubai retail conglomerate behind Centrepoint, Max and Babyshop, to its leak site. The listing claims customer-account counts for eight Gulf online storefronts, with no record totals or verified samples published. Landmark Group has not publicly commented.

By HIFY Radar newsroom Updated 11/09/2026 11:11 PM Get this every day →← Back to the feed 1 source

LowBreachNo software to update

In 30 seconds

Observed

Threat-intelligence account DailyDarkWeb reports that the N0n data-extortion group has put Landmark Group, the Dubai-based retail conglomerate behind Centrepoint, Max, Home Centre, Babyshop and Lifestyle, on its leak site, the public board where these groups name victims to pressure them.

Alleged

The listing claims customer-account counts for 8 of the group's Gulf online storefronts, but publishes no record totals and no verified data samples. Landmark Group has not confirmed any incident, so this remains a threat-actor claim rather than a verified breach.

What happened

Observed

On November 9, 2026, DailyDarkWeb posted a screenshot of the N0n leak site showing Landmark Group listed as a victim, the latest in a run of big names the group has posted this month.

Alleged

According to the listing, N0n claims customer-account counts for 8 Gulf online storefronts belonging to the retail group. Separately, and earlier, N0n had listed Centrepoint on its own, claiming loyalty-program member names and email addresses.

Observed

As of the reporting, no record totals, no samples and no technical proof have been published, and Landmark Group has not confirmed an incident.

Why it matters

Observed

Landmark Group is a major Dubai retail conglomerate whose brands, Centrepoint, Max, Home Centre, Babyshop and Lifestyle, are household names across the Gulf.

Inferred

The analyst note spells out the practical stake: if the claim is real, shoppers across the Gulf could face targeted phishing and account-takeover attempts, meaning criminals trying to log into their accounts, dressed up as messages from these familiar retail brands.

What to do

Inferred

Treat the listing as an unverified threat-actor claim rather than a confirmed breach, which is exactly how DailyDarkWeb frames it.

Inferred

For shoppers, the sensible moves are the usual ones: be skeptical of emails or texts referencing these brands, avoid clicking account-update links, and turn on two-factor authentication. For defenders, an unverified listing still justifies a quiet check of authentication logs on the named storefronts.

Confirmed and still uncertain

Alleged

What is claimed: customer-account counts across 8 Gulf storefronts, plus an earlier, separate listing for Centrepoint that included loyalty-program names and emails.

Observed

What is not known: whether any data was actually taken, how many records are involved, whether samples exist, and what Landmark Group will say. The company has not commented, and the current evidence contains no independent verification.

What people are saying

Observed

DailyDarkWeb's analyst note is blunt: N0n has posted many large names in bulk this month, often with little proof, and the listing should be treated as an unverified threat-actor claim, not confirmation of a breach.

Observed

N0n itself, through its leak-site listing, is effectively alleging it holds customer account data. Landmark Group has said nothing publicly, and no other voice appears in the current evidence.

Evolution

Observed

The story builds in two steps: first an earlier, separate N0n listing for Centrepoint claiming loyalty-program names and emails, then the broader Landmark Group entry covering 8 Gulf storefronts.

Observed

The Landmark listing also fits N0n's pattern this month of bulk-posting large names, often with thin evidence attached.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The claimed material is specific in shape but thin in substance: per-storefront customer-account counts, and, for the earlier Centrepoint listing, loyalty-program names and email addresses.

Observed

This is leak-site extortion mechanics, naming a victim publicly to pressure them, and the absence of record totals or verified samples means there is currently nothing technical to validate the claim against.

Sources and evidence

Observed

The entire evidence base is a single X post from DailyDarkWeb published on November 9, 2026, which includes a screenshot credited to the account and an explicit analyst note urging caution.

Observed

That is a thin base: one threat-intelligence account relaying a threat actor's own claims. There is no statement from Landmark Group, no second source and no data samples, so every assertion about the incident itself carries the caveat unverified.