UAE Cyber Security Council Warns Public Wi-Fi Breaches Surge, With Over 12,000 Incidents Making Up Nearly 35% of This Year’s UAE Attacks

A new warning from the UAE’s Cyber Security Council highlights the growing dangers of connecting to open public Wi-Fi networks. After recording more than 12,000 breaches linked to such connections since the start of the year, the council notes these incidents now account for roughly 35 percent of all cyberattacks reported in the UAE this year. The warning underscores how unsecured networks can be exploited by hackers to steal passwords, banking details, and a range of personal information. In response, the CSC urged cautious behavior when accessing free or untrusted Wi-Fi, especially in high-traffic spaces like cafes, airports, and shopping centres. The council also emphasized concrete safety measures, including multi-factor authentication, reliable security tools, and trusted VPN applications. Dr. Mohammed Al Kuwaiti, who heads cyber security for the UAE government at the CSC, told the state news agency that, under the directives of the country’s leadership, the council will continue its work to create a secure cyber environment, strengthen trust within the digital ecosystem, and raise awareness of safe digital practices. Building cyber resilience is framed around three essential steps designed to help users stay protected online, with the CSC outlining practical guidance and ongoing national initiatives through its Cyber Pulse awareness campaign.

Rising threats from open public Wi‑Fi and the scale of breaches

The UAE Cyber Security Council has brought attention to a persistent and widening risk: the widespread use of open, public Wi‑Fi networks in everyday life. The council reveals that the more than 12,000 breaches recorded since the beginning of the year are connected to such connections and that these incidents constitute a substantial share of the national cyber threat landscape. This level of activity signals that insecure networks remain an attractive entry point for cybercriminals seeking quick access to sensitive data. The clear takeaway is that consumers and organisations alike face elevated risks whenever they connect to networks without verified security measures. Passwords, banking details, and personal information are particularly vulnerable in these environments, where attackers can exploit weak encryption, unsecured traffic, or compromised hotspot configurations. The CSC’s assessment signals a warning to businesses that rely on public concessions or venues offering free Wi‑Fi, as well as to individuals who frequently roam and work remotely in public spaces. The council’s data reinforces the notion that threats are not abstract; they translate into tangible risks for everyday digital activities, including online banking, email communications, and personal account management. To this end, the council’s findings emphasize that the problem is not confined to a single type of site or service but spans a broad spectrum of online interactions that individuals undertake across public spaces. The fact that these incidents represent about one in three cyber incidents in the UAE this year highlights the pervasiveness of the risk and the need for broad-based protective measures that can be adopted by both individuals and organisations. In practical terms, the warning serves as a reminder that the convenience of free connectivity should not come at the cost of security, and that vigilance and proper safeguards are essential to reducing exposure to cyber threats. The CSC also points out that the vulnerabilities of public Wi‑Fi networks extend beyond data theft to more complex attack vectors, including the potential for manipulation of user traffic and the redirection of users to fraudulent sites or compromised portals. As these dynamics unfold, the importance of layered security practices becomes increasingly evident, underscoring the need for a thoughtful combination of technology, user awareness, and institutional policy to curb risk across the digital landscape. The broader implication is that both the public and private sectors must invest in timely education and robust security controls to ensure the digital ecosystem remains trustworthy and resilient in the face of evolving threats.

The nature of risks and how threats manifest

Public Wi‑Fi networks can become fertile ground for a range of cyber threats, and the CSC highlights several prominent modalities. One key risk is the man‑in‑the‑middle (MITM) attack, where an attacker positions themselves between the user and the intended website or service, allowing them to intercept, modify, or steal sensitive information as it travels over the network. Another danger is traffic redirection, in which users are unknowingly steered toward fraudulent or malicious pages that mimic legitimate sites, enabling credential harvesting or fraudulent activity. The installation of spyware or malware can occur quietly if a user unwittingly triggers a malicious download or connects to a compromised portal. In some cases, attackers leverage social engineering or phishing tactics to increase the chance of user error, such as displaying convincing login prompts or fake security notices intended to coax users into revealing credentials or personal data. The CSC’s examination of these threats reflects a broad and ongoing risk landscape, where attackers continuously seek to exploit the inherent vulnerabilities of unsecured networks. Given these dynamics, it becomes clear that mere caution is not sufficient; a structured strategy combining technology, user practices, and organizational policies is required to reduce risk. The CSC’s warnings also imply that family members, employees, students, and professionals who rely on public Wi‑Fi for daily tasks must adopt a consistent approach to online safety, particularly when handling financial information, personal records, or access to critical services. In effect, the threat spectrum underlines the urgency of comprehensive cyber resilience measures that can withstand evolving attack techniques and safeguard user data, privacy, and digital integrity across diverse settings and devices.

Practical protection: three core recommendations and how to apply them

To address the heightened exposure associated with public Wi‑Fi, the CSC has delineated three principal recommendations designed to empower users to stay protected online. First, the council urges the use of a trusted VPN to encrypt digital connections. A Virtual Private Network (VPN) creates a secure tunnel for data, preventing on‑lookers on the same network from easily reading sensitive information such as passwords, financial details, and personal messages. The recommended approach is to choose reputable VPN providers with robust privacy policies, strong encryption standards, and a track record of safeguarding user data. It is important to avoid free VPN services that may compromise privacy in exchange for data, or that may fail to deliver adequate protection. In practical terms, users should enable their VPN whenever they connect to any public or shared network, ensuring that both browsing and application traffic are encapsulated within an encrypted channel. The second recommendation focuses on turning on “safe browsing” features within web browsers. These features can help identify potentially dangerous sites, block malicious content, and warn users about deceptive websites or insecure connections. Safe browsing practices extend beyond browser settings and should be complemented by vigilance regarding URL accuracy, site reputation, and the presence of HTTPS protection. By combining VPN protection with browser-level safety measures, users establish multiple layers of defence that can reduce the likelihood of credential compromise and data exfiltration. The third recommendation emphasizes avoiding logging into sensitive accounts—such as banking or personal email—over public Wi‑Fi networks. Refraining from initiating or confirming high‑risk transactions on public networks is a straightforward but highly effective precaution. When possible, users should perform sensitive actions over secure, trusted networks or through secured devices, and consider alternatives such as mobile data connections for critical operations. In addition to these three core steps, the CSC underscores the broader importance of adopting strong authentication practices, enabling multi‑factor authentication (MFA), and utilising trusted security tools that provide endpoint protection, anti‑malware capabilities, and regular security updates. MFA adds an extra verification layer by requiring more than a password, such as a one‑time code or biometric confirmation, significantly reducing the risk posed by stolen credentials. Trusted security tools can include reputable antivirus software, privacy‑focused browser extensions, and system updates that patch known vulnerabilities. The CSC’s guidance also encourages users to be mindful of device settings that can inadvertently expose data when connected to public networks, such as enabling file sharing or network discovery, which should be disabled in public environments. Taken together, these measures form a practical, multi‑layered approach to reducing risk in public Wi‑Fi scenarios, aligning user behaviour with security best practices while complementing organisational cybersecurity programmes. For individuals, adopting these steps can dramatically diminish the likelihood that a casual connection in a public space translates into a data breach. For institutions, these recommendations should be embedded in user education campaigns, supported by network controls, and reinforced through routine security audits and incident response planning to minimize potential impact when breaches occur. The CSC’s three‑step framework thus serves as a concise, actionable blueprint that can be consistently applied by different user groups to improve cyber resilience in the face of public network threats.

Additional defensive measures and best practices

Beyond the three core recommendations, the CSC advocates broader defensive measures to enhance security while using public networks. One important practice is to avoid auto‑connect features on devices, which can connect to the first available network without user consent, potentially steering users toward insecure hotspots. Manually selecting trusted networks ensures greater awareness of the network in use and reduces the chance of connecting to rogue access points. Regular software updates and operating system patches are another critical line of defence; they help close known vulnerabilities that attackers might exploit on public networks. Users should also enable firewall protections and ensure that security settings are properly configured across all devices, including smartphones, tablets, and laptops. A comprehensive approach includes educating users about phishing indicators and suspicious prompts that may be presented while connected to public networks. The CSC’s emphasis on digital hygiene speaks to a broader culture of safe online behaviour, where individuals remain vigilant about the legitimacy of websites, the integrity of login processes, and the authenticity of security notices.

The CSC’s Cyber Pulse awareness campaign, which has returned this year for its second edition, is a central element of a wider national strategy to enhance cyber resilience and digital hygiene. This campaign targets both institutions and individuals, aiming to raise awareness about cybersecurity best practices, promote safer digital behaviours, and encourage the adoption of protective measures across diverse communities. The initiative aligns with broader national efforts to strengthen cyber readiness, reduce susceptibility to cyber threats, and foster a more secure digital ecosystem for commerce, education, and daily life. The return of Cyber Pulse highlights the government’s ongoing commitment to improving cyber literacy, reinforcing protective norms, and encouraging proactive engagement with cybersecurity resources. In practical terms, the campaign likely includes social media outreach, educational materials, community workshops, and collaboration with public‑private partners to disseminate essential guidance. While the content focuses on public Wi‑Fi risk, its scope is intentionally broad, addressing digital hygiene and resilience across multiple domains, including workplaces, schools, healthcare, and government services. As part of this national initiative, organisations and individuals are encouraged to adopt the recommended practices, participate in awareness activities, and integrate cyber resilience into everyday routines. The reintroduction of the Cyber Pulse campaign marks a meaningful step in sustaining momentum, reinforcing the message that cybersecurity is a shared responsibility, and that consistent, practical actions can collectively raise the level of protection within the UAE’s digital landscape.

The policy context, leadership view, and implications for trust in the digital ecosystem

Dr. Mohammed Al Kuwaiti, who leads the UAE government’s cyber security efforts at the CSC, emphasised that the country’s leadership directs ongoing work to cultivate a secure cyber environment. His comments underscore a governmental commitment to strengthening trust in the digital ecosystem, as well as a focus on raising awareness of safe digital practices across the population. The CSC’s mission, as articulated by Dr. Al Kuwaiti, is to build cyber resilience through a combination of policy direction, public education, and practical safeguards. This approach reflects a holistic view of cybersecurity that integrates technical controls with community engagement, aiming to reduce risk and improve overall digital hygiene. The leadership’s emphasis on secure cyber practices is paired with a broader objective: to ensure that digital technologies and online services remain trustworthy, accessible, and robust against evolving threats. For individuals and organisations operating in the UAE, the message is clear: adherence to recommended protections and active participation in cybersecurity initiatives are essential to maintaining secure digital operations. The CSC highlights that secure behaviours, when reinforced by trusted tools and policies, contribute to a more resilient cyber environment capable of withstanding current and future attack vectors. The combination of leadership focus, practical guidance, and public awareness campaigns demonstrates a comprehensive strategy designed to mitigate risk while encouraging innovation and digital participation in a secure framework. In this context, the UAE’s cyber resilience agenda is not only about reacting to incidents but also about proactive prevention, proactive education, and the establishment of enduring norms that align technology use with robust security practices. The resulting outcomes are expected to include reduced exposure to threats, greater user confidence in digital services, and a healthier national digital economy driven by safer online interactions across sectors.

Implications for institutions, consumers, and the path forward

The CSC’s warning and guidance have broad implications for both institutions and individual consumers. For institutions, there is a need to implement and enforce cybersecurity policies that dovetail with the three‑step framework and the wider digital hygiene ethos promoted by the Cyber Pulse campaign. This includes ensuring employees and customers understand the risks of public Wi‑Fi, deploying network controls that minimise exposure to insecure networks, and integrating MFA, secure authentication protocols, and endpoint protection into everyday operations. Institutions should also consider providing guidance and tools to help users connect securely when they must access services remotely, including policy‑driven VPN access, device management, and incident response protocols. For individuals, the message is practical and actionable: prioritise security when using public networks, invest in reputable VPN services, enable browser safety features, and avoid handling sensitive transactions on public connections. The guidance also emphasises the importance of non‑technical protective practices, such as remaining vigilant for phishing attempts, verifying the legitimacy of websites before entering credentials, and maintaining updated devices with current security patches. The 12,000 breach figure serves as a stark reminder that cyber threats are not theoretical; they translate into real risks that can affect everyday digital lives. By aligning personal habits with professional recommendations, both individuals and organisations can collectively strengthen the UAE’s cybersecurity posture. In terms of long‑term strategy, the CSC’s three‑step framework, coupled with ongoing Cyber Pulse outreach and leadership support, sets the stage for a more resilient digital economy. This involves continuous education, regular security assessments, and a culture that prioritizes safe digital practices as standard operating procedure across workplaces, schools, and households. The practical takeaway is clear: security is a shared responsibility that benefits everyone when it becomes a routine part of how we connect, transact, and interact online.

Conclusion

The UAE Cyber Security Council’s recent findings underscore a pressing reality: open public Wi‑Fi networks continue to pose significant cybersecurity risks, with thousands of breaches and a large share of the year’s cyberattacks tied to unsecured connections. The data call for heightened caution and practical safeguards as a matter of national importance. By adopting the CSC’s three core recommendations—using a trusted VPN to encrypt connections, enabling safe browsing features, and avoiding login to sensitive accounts on public networks—along with broader protective measures and active participation in the Cyber Pulse awareness campaign, individuals can reduce their vulnerability to the most common attack vectors, such as man‑in‑the‑middle exploits, site redirections, and malware installations. The leadership perspective emphasizes a sustained commitment to building a secure cyber environment and restoring trust in the digital ecosystem, with safety practices reinforced through education, policy, and community engagement. Looking ahead, the combined efforts of government, institutions, and citizens to strengthen cyber resilience demonstrate a proactive approach to safeguarding personal data and critical digital services, ensuring that UAE’s digital landscape remains trustworthy, resilient, and capable of supporting innovation and everyday online activity.