Data Security Failures Prompt $585k Penalty for DIFC Credit Rating Agency

The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East Limited $585,825 (Dh2.15 million) following repeated failures to protect confidential and market-sensitive data. The fine, announced on Wednesday, 28 October, follows an investigation into seven separate incidents of inadvertent data disclosure reported by the company between December 2023 and May 2026. Security tools discontinued According to the regulator, four of the seven reported incidents involved confidential data being leaked to external recipients. The DFSA investigation found that Moody’s Middle East discontinued a critical data security tool without implementing an immediate replacement, leaving information vulnerable. The regulator also identified inadequate systems for detecting breaches and ineffective internal disciplinary processes for employees responsible for these lapses. Moody’s Middle East, which has held a DFSA credit rating agency licence since December 2012, agreed to settle the matter. The final penalty includes an early settlement discount; without this reduction, the fine would have amounted to $836,892. The agency handles high volumes of sensitive information related to governments, public corporations, and private entities within the Dubai International Financial Centre (DIFC). Market integrity concerns Alan Linning, Managing Director of Enforcement at the DFSA, stated that the agency’s failures breached specific rules applicable to credit rating…