Saudi Arabia
Government Intelligence
Personnel & Operational Data
Published
Unverified
Saudi Intelligence Officers Database Claim Includes Names, Contact Details and Operational Records
Overview
An actor using the handle "UWAYS" claims to have published a database associated with Saudi Arabia's General Intelligence Presidency (GIP). The post attributes the disclosure to the Uways Qarani group and claims the material concerns personnel within the Saudi foreign intelligence service.
According to the post, the purported dataset includes real names of officers, mobile phone numbers, home addresses, direct workplace telephone lines, home telephone numbers, positions, active case files, organizational details, an administrative chart and a list of operational stations worldwide. A direct download location is shown in the source material, but it is not reproduced in this report. The authenticity, completeness, source and current availability of the claimed dataset have not been independently verified.
Post details
Saudi ArabiaWhat the post claims
- Database associated with Saudi foreign intelligence
- Real names of officers included
- Mobile phone numbers included
- Home addresses included
- Direct workplace telephone lines included
- Home telephone numbers included
- Officer positions included
- Active case files included
- Organizational details included
- Administrative chart included
- Operational stations worldwide listed
- Material made available for download
The post presents the disclosure as a broad compromise of intelligence personnel and operational information. The screenshot also contains sample material with names and phone numbers; those personal details are not transcribed in this report.
Screenshots
IOCs & contact identifiers
Identifiers directly visible in the supplied material. These support correlation and do not independently verify the dataset claim or identify the individuals behind the accounts.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | UWAYS | Screenshot 1 |
| Actor website | uways[.]to | Screenshot 1 |
| Telegram | @UWAYS_QARANI | Screenshot 1 |
The direct download location visible in the source material is intentionally not reproduced because it points to the purported leaked dataset. No malware hash is visible. Personal identifiers shown in the purported evidence are not included in this table. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The actor claims possession and publication of a structured intelligence-service database containing personnel, contact, organizational and case-related records. The supplied material does not reveal the acquisition method or independently establish unauthorized access to GIP systems.
Potential impact
If authentic, the claimed exposure could create significant risks for affected personnel by revealing identity information, phone numbers, home addresses, workplace contact details, positions and operational context. The claimed inclusion of active case files, organizational structure and overseas station information could also create broader counterintelligence, physical-security and operational-security concerns.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, completeness, source, current availability or the actor's claim that it represents a complete Saudi intelligence-service database. The supplied screenshot documents the claim, associated contact channels and sample material, not independent confirmation of the underlying dataset.
