The DFSA says four of the seven reported confidentiality incidents involved external recipients and cites the absence of a replacement security tool among control failures.
Seven disclosure incidents were reported to the regulator between December 2023 and May 2026. The decision identifies a gap between removal and replacement of an email-security control.