Shukran loyalty data breach: Landmark Group investigating incident

What happened

Landmark Group, the Dubai-based retail and hospitality group, is investigating a cyber incident after customer data linked to its Shukran loyalty programme was accessed, according to Arabian Business. Customer names, contact details and dates of birth were exposed, while payment card information and loyalty points are reported to remain secure.

The disclosure confirms that an investigation is under way. The available reporting does not describe how the access occurred, how many customers were affected, or when the incident was first detected. Those details will matter for customers deciding how to respond, and they should be treated as open questions until the company provides them.

Why it matters

Loyalty programmes rest on an exchange: customers share personal details in return for relevance, rewards and convenience. When names, contact details and birth dates are exposed, the damage extends beyond the security function. The data that powers personalised communication and customer recognition is the same data now in question, so the trust cost falls directly on the customer experience.

For leaders in digital transformation, the incident is a reminder that every connected service adds another point where customer data can leak. As retailers bring loyalty, payments and marketing onto shared platforms, security architecture stops being a back-office concern and becomes part of the journey the customer sees. Resilience, transparent communication and clear recovery paths are now part of service design, not an afterthought.

The Renascence take

Coverage of incidents like this tends to lead with what was not taken and whether cards are safe. That is a useful headline, but it is not the question the customer is asking. The more important test is what the customer now has to do, and how easily they can do it.

Most readers will focus on the reassuring line that payment cards and loyalty points were not affected, but the real experience question is what the customer must do next. Behavioural research on loss and trust suggests people judge a brand by how it handles recovery, not by its promises at the outset. A customer-obsessed operator should publish a plain-language notice that states exactly what was exposed and what to watch for, provide one clear contact route, and commit to a visible update cadence until the investigation closes.