CyphrQ
Menu

VentureRock 2023 ADGM Data Breach Case: One Hijacked Mailbox, No Fine

How a hijacked Microsoft 365 mailbox led ADGM's data regulator to reprimand VentureRock in 2023, why there was no fine, and what to check in your estate.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: February 202310 min read

What happened in the VentureRock ADGM data breach case? In February 2023, an attacker took over a Microsoft 365 mailbox at VentureRock Global Limited, a newly licensed firm in Abu Dhabi Global Market (ADGM), and used it to send phishing emails. ADGM's Commissioner of Data Protection found that the firm had no security policies and no two-factor authentication. On 23 June 2023 it issued a formal reprimand and ordered fixes, but no fine (ADGM Direction 01-2023).

It is a small case. That is why it is useful: almost every business in the region has a mailbox like this one. And it is one of very few Middle East breach decisions where the regulator has published its full reasoning.

This article is by CyphrQ.ai. Every figure below comes from the regulator's own documents, linked inline.

Case file

Field Verified value
Organisation VentureRock Global Limited
Region UAE, Abu Dhabi Global Market (ADGM)
Breach date Account takeover likely around 11 February 2023 (independent assessor's view); phishing sent 20 February 2023
Disclosed Reported to the ADGM Office of Data Protection by ADGM Information Security on 20 February 2023; regulator's Direction dated 23 June 2023
People affected Not stated by the regulator
Data types Email addresses and the contents of one Microsoft 365 mailbox
Penalty None published (reprimand and directions, no fine)
Regulator ADGM Commissioner of Data Protection
Status Direction issued; four-month progress update required; outcome not published

Source for every row: ADGM Direction 01-2023 and the ADGM regulatory actions page.

What happened at VentureRock, and when?

VentureRock was incorporated and licensed to operate in ADGM on 14 February 2023. It had applied to ADGM's Financial Services Regulatory Authority to advise on investments, arrange deals and manage a collective investment fund (Direction, section 3).

Six days later, the problem surfaced. The Direction sets out the timeline:

  • 20 February 2023, 07:34: a phishing email is sent from the email address of an individual at VentureRock to ADGM employees.
  • 20 February 2023, 12:08: ADGM Information Security tells the Office of Data Protection (ODP).
  • 20 February 2023, 12:55: the ODP asks VentureRock to complete a breach notification form by 24 February.
  • 21 February and 17 March 2023: VentureRock returns the form twice. The regulator says neither version contained sufficient detail.
  • 28 March 2023: the Commissioner issues an Order compelling a technical investigation report within 40 days.
  • 8 May 2023: VentureRock submits an independent assessment report dated 11 April 2023.
  • 23 June 2023: the Commissioner issues the Direction.

Note who raised the alarm. It was not the breached company. It was the security team at the organisation receiving the phishing.

Whose data did the VentureRock breach expose, and how many people?

The regulator does not give a number. What it does say is specific: "email addresses and the content of the Microsoft Office account were accessible by the malicious third party" (Direction, 6.2.7).

The assessor's report, quoted in the Direction, says the attacker could "send phishing emails to all contacts registered in the client's mailbox." The ODP's preliminary view was that all information in the account "was at risk and could have been viewed, accessed or exfiltrated."

So the people affected are everyone whose details sat in that mailbox, plus everyone who received the phishing. Neither group is counted in the published decision.

How was the VentureRock mailbox hijacked?

The official account comes from the independent assessment, as summarised by the regulator (Direction, 5.2):

  1. Likely entry point: "account hijacking by credential harvesting through free Wi-Fi provided at the airport lounge during a trip to Abu Dhabi and Doha." The word "likely" is the assessor's. The method was not proven.
  2. Mailbox access: the attacker had direct access to the mailbox.
  3. Hiding: a new inbox rule redirected all incoming mail to a folder called "Conversation History", which the assessor called proof of access to the mailbox history.
  4. Onward phishing: emails went out to the mailbox's contacts. A message trace found two suspicious IP addresses.

Then the gaps. There were no policies or procedures. The only technical control was a free antivirus licence. There was no two-factor authentication on Microsoft services. And no logs were kept before 12 March 2023, so the start of the intrusion can't be reconstructed.

The regulator adds one more point. VentureRock brought in assessors 21 days after the incident, and in the meantime its own clean-up "removed historic data", which made the investigation harder (Direction, 6.2.6).

The assessor's own conclusion: the "incident could have been avoided if basic cyber hygiene had been followed."

What did ADGM decide in this data breach case, and why no fine?

The Commissioner found breaches of four parts of ADGM's Data Protection Regulations 2021 (DPR 2021):

  • Section 4(1)(f): the security principle.
  • Sections 22(1) and (2): appropriate technical and organisational measures, including data protection policies.
  • Section 29: the duty to cooperate with the Commissioner.
  • Sections 30(1) and (2): security appropriate to the risk.

The response was a Direction with two parts: a formal reprimand, and an order to report back within four months on measures covering backups, updates and patches, public Wi-Fi and remote working, password management, and training (Direction, section 7 and Annex 1).

The Direction does not explain in one sentence why it chose not to fine. It does list the mitigating factors it weighed:

  • VentureRock was newly established.
  • It took remedial steps.
  • It "appears to have notified most of the affected contacts to disregard the email."
  • There was "no evidence of individuals suffering any damage or distress."
  • There was no evidence of deliberate contravention.
  • It committed to implementing the assessor's recommendations.

Fines were available. The DPR 2021 caps a fine at USD 28 million, and ADGM has used the power. In May 2024 it fined Okadoc Technologies Limited USD 20,000 for mishandling an employee's data subject access request and failing to cooperate, reduced to USD 16,000 for early payment (ADGM Penalty Notice 1/2024).

In practice: as of 25 October 2026, ADGM's regulatory actions page lists just these two actions. The breach got a reprimand; the access-request failure got the fine.

Why isn't Careem's 2018 breach the case study?

Careem's April 2018 breach notice is the region's best-known disclosure. We checked it first. Its original page on Careem's blog no longer loads, and the widely quoted count of affected users comes from press reports of a spokesperson's comments, not from a document we could read. Under our rules, that figure stays out.

The legal context is still worth knowing. In 2018 the UAE had no federal data protection law. The PDPL came into force on 2 January 2022 (u.ae). We found no published regulator decision on the Careem breach.

What has changed in Middle East data protection law since?

  • UAE (mainland): the Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, is on the UAE Legislation portal and has been in force since 2 January 2022 (u.ae). Its breach notification period and penalties depend on Executive Regulations. When we checked for our PDPL guide on 24 October 2026, no primary government source showed them as issued.
  • UAE free zones: ADGM (DPR 2021, with its own Office of Data Protection) and DIFC (Data Protection Law No. 5 of 2020, with its own Commissioner) run separate regimes. VentureRock fell under ADGM's.
  • Saudi Arabia: SDAIA's National Data Governance Platform records the Personal Data Protection Law as issued on 16 September 2021. Check the platform for the current implementing regulations before relying on any summary. Our Saudi PDPL requirements guide covers the duties in detail.

The regional pattern: the laws exist, but published enforcement decisions are still rare.

What does this cost when it goes wrong?

IBM's 2025 Middle East findings put the average cost of a data breach in the region at SAR 27.00 million, down about 18% from SAR 32.80 million the year before. Phishing accounted for 14% of breaches in the region (IBM Middle East newsroom, 30 July 2025).

VentureRock's report found no two-factor authentication at all. Set that regional average against the effort of switching it on, and the argument makes itself.

Going deeper: for security and IT teams

Attack path, as the official sources describe it. The Direction describes a cloud mailbox takeover. Mapped to MITRE ATT&CK, using only what the regulator states:

Threat model. A low-cost attacker needs one password and no second factor. The payoff is a trusted sender address and every contact in it. The victim here was a six-day-old firm, but the people receiving the phishing were staff at a financial free-zone authority.

Controls that would have mattered (ATT&CK mitigation IDs from the pages above):

  • M1032 Multi-factor Authentication on every cloud mailbox. Microsoft recommends enabling and enforcing MFA, and phishing-resistant MFA for admins (Microsoft Learn).
  • M1036 Account Use Policies: Conditional Access to block sign-ins from non-compliant devices or outside defined IP ranges.
  • M1015 Active Directory Configuration: disable legacy authentication.
  • M1047 Audit: review inbox rules on a schedule.
  • M1031 Network Intrusion Prevention and M1017 User Training against rogue Wi-Fi: wireless IPS where you control the network, and training to distrust open networks and certificate errors where you don't.
  • The organisational items the regulator ordered (Annex 1): backups on work devices, patching, a public Wi-Fi and remote-working policy, password management, and training.

Detection and response in Microsoft 365. Microsoft's compromised-account guidance lists the symptoms seen here: suspicious inbox rules, including rules that move messages to folders, and suspicious messages in Sent Items. Its response steps, in order:

  1. Disable the account (Update-MgUser -AccountEnabled $false) or reset the password. Don't send the new password by email.
  2. Revoke sessions and refresh tokens with Revoke-MgUserSignInSession.
  3. Review registered MFA methods and remove unknown ones.
  4. Review app consents and admin roles.
  5. Check forwarding (Get-Mailbox | Format-List Forwarding*Address,DeliverTo*) and all rules, including hidden ones (Get-InboxRule -Mailbox <Identity> -IncludeHidden).

App passwords are not revoked automatically when you reset the password, so delete them separately. Then investigate with Entra sign-in logs (IP address, location, time, success or failure), the audit log search in the Defender portal, and message trace.

The evidence lesson. VentureRock had no logs before 12 March 2023, and its own clean-up removed historic data. Export sign-in logs, audit records, the inbox rules and the message trace before you remediate. Confirm how long your licence keeps audit data, and whether that covers the weeks an intrusion can go unnoticed.

What to verify in your own estate:

  • Is MFA enforced for every mailbox, including founders, shared mailboxes and service accounts?
  • Is legacy authentication blocked tenant-wide?
  • Do you alert on new inbox rules that move, delete or redirect mail?
  • Who receives external reports that "your account sent us phishing", and how fast can they act?
  • Is there a written incident procedure that names who files the regulator's breach form? VentureRock's two incomplete forms preceded the regulator's finding that it failed to cooperate under section 29.

Key takeaways

  • The VentureRock breach began with one mailbox without two-factor authentication. The likely entry point, per the assessor, was credentials harvested on airport lounge Wi-Fi.
  • ADGM's Commissioner reprimanded the firm and ordered fixes, but imposed no fine. The Direction lists six mitigating factors, including no evidence of damage or distress.
  • Poor cooperation was a finding in its own right. Incomplete breach forms count against you.
  • ADGM can fine up to USD 28 million and has fined before: USD 20,000 against Okadoc in 2024.
  • Across the region, published breach decisions remain rare. The UAE's mainland PDPL still awaits Executive Regulations.
  • This week: enforce MFA, block legacy authentication, alert on new inbox rules, and write down who preserves logs before anyone starts cleaning up.

Sources