Why does the Middle East lose so much money to cybercrime?
Saudi Arabia and the UAE top a global cybersecurity list compiled by a United Nations agency. But they also lose millions of dollars each year to cybercrime – and the numbers continue to rise.
Why does this happen?
According to DW, cybercrime causes trillions of dollars in damage to governments and businesses every year, but the level of damage is uneven across countries.
According to IBM-funded research that looked at data breaches in 16 countries, cybercrime in the Middle East will cost an average of more than $8 million (€7.2 million) per incident by 2023. Saudi Arabia and the UAE are the second-highest in the world in terms of financial losses, according to the study.
The cost of cybercrime in the UAE and Saudi Arabia has been rising for years. In 2018, the same annual study found that the average cost of a cyberattack there was just $5.31 million.
DW said it is important to consider the increase in the context of the development of the e-commerce sector and the increasing level of internet usage, which has led to more locals going online than ever before. However, according to relevant ministries in Saudi Arabia and the UAE, they need to be well protected.
The International Telecommunication Union (ITU), a specialized agency of the United Nations, regularly publishes rankings of global cybersecurity capabilities, and in the most recent rankings from 2020, Saudi Arabia and the UAE topped the rankings.
However, experts say the rankings are based on information provided by the countries themselves and that while cybersecurity is increasingly taken seriously in the region, there may still be a gap between the policies that Gulf states talk about and their actual effectiveness.
“The UAE, Saudi Arabia and Qatar are doing very well in digitizing public services and also have thriving small and medium-sized enterprises,” said Joyce Hakmeh, deputy director of the International Security Program at the UK think tank Chatham House and an expert on cyber policy.
“But as is often the case – and this is not just in the Gulf, but all over the world – digital transformation is happening so quickly that it can compromise the implementation of proper cybersecurity measures,” he added.
“The Middle East is a hotbed of data breaches, largely due to digitization outpacing the ability of cybersecurity infrastructure to respond,” said Mohammed Soliman, director of the Cybersecurity and Strategic Technology program at the Middle East Institute in Washington.
Blackmailing the richest people in the world
The majority of cyberattacks worldwide are financially motivated, US company Verizon said in its 2024 Data Breach Investigations Report. And the same is true for the Middle East. According to Verizon, in the Middle East, Europe and North Africa, 94% of cyberattacks are financially motivated, with only 6% being politically motivated.
One of the most common methods of extorting organizations is using ransomware, a type of malware that encrypts or locks data until a ransom is paid.
Saudi Arabia and the UAE are home to some of the world’s richest organizations, including sovereign wealth funds and oil companies. According to a report by British cybersecurity firm Sophos, the companies most likely to be hit by ransomware are those with the highest revenues.
In a 2024 survey of 5,000 industry professionals, mostly in Europe, Sophos found that less than half of organizations with revenues under $10 million had been hit by ransomware. But that number rose to 67% when their revenues exceeded $5 billion per year.
Wealthier companies are also more likely to pay the full ransom, according to an anonymous survey by Sophos. More than half of companies hit by ransomware pay the ransom. But organizations with revenues of more than $5 billion are more likely to pay the full amount, while others may be able to negotiate a lower price.
Other research suggests the percentage of UAE companies deciding to pay the full ransom may be even higher, with a survey by a cybersecurity firm finding that around 84% of them agreed to pay the extortionists.
Cybercrime is everywhere. But what puts the Gulf states at the top of the list of most costly incidents, experts say, can be explained by a combination of high-value targets, rapid digitalization and a lack of cybersecurity measures, along with the increasing sophistication of threat actors.
