Gulf and Israeli outlets spent the week recirculating cyber figures that predate it
A Microsoft telemetry report from 1 October, a UAE aggregate from May, and a vendor dashboard mixing confirmed statements with Telegram boasts all ran as current.
Microsoft’s Digital Defense Report 2026 was published around 1 October, outside the past week, but its numbers circulated through Gulf and Israeli media for days afterwards. The report, based on telemetry across Microsoft systems processing over 165 trillion security signals daily, places Israel second globally among countries whose customers were targeted, at 7.6%, behind the United States at 25.5% and ahead of Ukraine at 4.8%, Taiwan at 3.9% and the United Kingdom at 3.8%. The UAE ranks sixth at 2.8%, and second across the Middle East and Africa. Of Iranian-attributed activity, 39% targeted Israel, 23% the United States and 9% the UAE, concentrated in research and higher education at 28%. Microsoft reports ransomware against Israel up 21% year-on-year. Yossi Karadi, head of Israel’s National Cyber Directorate, responded: “In cyberspace, you may not see missiles in the air, but there is no ceasefire.”
On 10 October, Gulf News and Gulf Today both ran the figure of more than 800,000 daily cyberattacks against the UAE. Both date it correctly in the body — the Cyber Security Council announced it in May 2026 — and both pegged their pieces to Cybersecurity Awareness Month and to capability announcements including the “She Protects” programme launched by Microsoft with CPX Holding, and a cybersecurity centre of excellence in Abu Dhabi announced with Dell Technologies. Separately, SOCRadar’s live Iran–Israel conflict dashboard, last dated 1 October, lists 47 active hacktivist and APT groups and 12 confirmed incidents across the GCC alongside unverified claimed data dumps, including a UAE passport database and an Israeli reserve-unit personnel file, and a confirmed statement from Jordan’s National Cybersecurity Center that it blocked an attack on the national wheat silo management system.
Assessment: Three different kinds of number were presented in one register last week. Microsoft’s is real measurement of a customer base, not of the world, and two secondary reports still disagree on whether the window was July 2025–June 2026 or the first half of 2026 — enough to disqualify any chart built on it until the primary document is read. The UAE’s 800,000 has no published methodology and almost certainly counts automated scanning; it is domestic messaging, not measurement. The vendor dashboard is the worst case, placing a Jordanian government statement in the same timeline as Telegram boasts, which is how unverified claims acquire a citation. Note also whose budget each figure serves.