Cyber-Extortion, Online Defamation, and Account Hacking: Penalty Ranges and Reporting Channels

The short answer

Article 3 of the Anti-Cyber Crime Law imposes up to one year's imprisonment and a fine of up to SAR 500,000, or either, for unlawful access to threaten or extort someone, and for defaming others and causing them harm through information technology. Article 5 imposes up to four years and SAR 3,000,000 for cancelling, leaking or republishing private data. Article 8 is the aggravation provision: the penalty is no less than half its maximum where an organised gang, an abused public office, exploitation of minors, or a prior conviction is involved.[1]

5 min read

This page is general awareness material based on the text of the Anti-Cyber Crime Law, issued by Royal Decree No. M/17 of 8/3/1428H, covering cyber-extortion, online defamation, account hacking and data leakage, and the official reporting channels. It does not assess the penalty for any specific incident and contains no defence strategy: the Law sets a range, and the final legal characterization rests with the competent authority. Source 1

Article 3: extortion, defamation, and violation of private life

Article 3 imposes imprisonment of up to one year and a fine of up to SAR 500,000, or either penalty, on several acts, including those this page covers: Source 2

Unlawful access to threaten or extort a person into an act or omission, even where that act or omission would itself be lawful. Source 3
Defaming others and causing them harm through the various means of information technology, including social platforms and digital messaging. Source 4
Violating private life through the misuse of camera-equipped mobile phones or their equivalent. Source 5
Unlawful access to a website to alter its design, damage it, modify it, or occupy its address. Source 6

Article 5: account hacking and data leakage

Article 5 imposes imprisonment of up to four years and a fine of up to SAR 3,000,000, or either, for unlawful access to cancel, delete, destroy, leak, damage, alter or republish private data, as well as for stopping or disabling the information network or erasing its programs and data, and for obstructing, jamming or disabling access to a service by any means. Source 7

Article 6: a distinct set of offences, not an aggravation of Article 3

Article 6 imposes imprisonment of up to five years and a fine of up to SAR 3,000,000, or either, for producing, preparing, sending or storing through the information network material that would affect public order, religious values, public morals, or the sanctity of private life, as well as for creating or publishing sites for human trafficking, pornographic material and gambling activity, or trafficking and promoting narcotics. Source 8

A common confusion is worth flagging: Article 6 is not an aggravated version of Article 3. It is a distinct set of offences with its own penalty. Characterizing a defamation incident as falling under Article 6 is not an escalation of the defamation penalty — it is attribution to a different offence with different elements, and it turns on the content itself rather than on how severe the insult was. The article was amended by Royal Decree No. M/54 of 22/7/1436H to permit publishing a summary of the judgment at the convicted person's expense once it becomes final. Source 9

Article 8: the actual aggravation provision

Aggravation in this Law sits in Article 8: the imprisonment or fine is no less than half its maximum where the offence is coupled with any of the following — and it applies to any offence in the Law, including extortion, defamation and data leakage: Source 10

The offender commits the offence through an organised gang. Source 11
The offender holds a public office and the offence is connected to it, or they committed it exploiting their powers or influence. Source 12
Luring and exploiting minors or those in their position. Source 13
Prior local or foreign convictions against the offender for similar offences. Source 14

Incitement and attempt: Articles 9 and 10

Article 9 punishes anyone who incites, assists, or agrees with another to commit any offence under the Law — up to the maximum penalty where the offence occurs on that basis, and up to half where the principal offence does not occur. Article 10 punishes an attempt at any of them by no more than half the maximum penalty prescribed. Source 15

Article 11: exemption where the offender reports first

The competent court may exempt from these penalties any offender who takes the initiative of reporting the offence to the competent authority before it becomes known and before harm occurs. Where the report comes after the offence is known, exemption requires that it lead to apprehending the remaining offenders where there are several, or to seizing the tools used in the offence. Source 16

Article 13: confiscation and site closure — with a condition

Without prejudice to the rights of those acting in good faith, a judgment may order confiscation of the devices, software or means used to commit any of the offences, or the proceeds obtained from them. A judgment may also order closure of the website or the service location, permanently or temporarily — but on two conditions together: that it was a source of the offence, and that the offence was committed with the owner's knowledge. Source 17

The competent authority: Articles 14 and 15

The Bureau of Investigation and Public Prosecution conducts investigation and prosecution of the offences under the Law by virtue of Article 15, and the Communications and Information Technology Commission, within its remit, provides technical support and assistance to the competent security authorities during the stages of detection, investigation and trial by virtue of Article 14. Source 18

How do you report cybercrime?

The Kollona Amn platform is an official channel that allows citizens and residents to submit security and criminal reports. Its published report categories include violation of private life, threats, impersonation, extortion, hacking of social media accounts, defamation, and fraud. Source 19

The published reporting steps are: open the app, choose the cybercrime report category, select the relevant subcategory, add a description and any available attachments, then submit the report. Source 20

Where an incident also involves financial fraud — such as using a hacked account to request money transfers from others — a separate service exists through Absher under Public Security services, named financial fraud reports. Its steps: open Absher, then My Services, then Public Security, then financial fraud reports, then fill in the fields and submit. Source 21

#	Step
1	Open the Kollona Amn app or the Absher platform depending on the type of report. Source 22
2	Choose the relevant report category, such as cybercrime or financial fraud. Source 23
3	Add the description and any available attachments — screenshots, links, relevant messages — then submit. Source 24
4	Use the emergency numbers where there is urgent danger requiring immediate intervention. Source 25

Emergency numbers

The Unified National Platform publishes 911 as the unified emergency number, and 999 for the police. These are for urgent situations requiring immediate intervention, and do not replace filing a detailed report through Kollona Amn or Absher for non-urgent matters. Source 26

When do you need a licensed lawyer?

This page is awareness material based on the published texts only. It does not assess the penalty for a specific incident and contains no defence strategy or prediction of a case's outcome. A licensed lawyer becomes a practical necessity where there is an active report, summons, arrest, investigation or charge, and equally where the aggravation in Article 8, the exemption in Article 11, or the confiscation and closure in Article 13 is in play — each of which turns on the facts and evidence of the file. Source 27

Save or share this guide card:

The image includes its creation date and time in Riyadh.

Share this guide with someone who needs it:

The shared link contains no inputs, results, or private details

Frequently asked questions

Is cyber-extortion a defined offence under Saudi law?

Yes. Article 3 of the Anti-Cyber Crime Law imposes imprisonment of up to one year and a fine of up to SAR 500,000, or either penalty, for unlawfully accessing a system to threaten or extort a person into an act or omission — even where that act or omission would itself be lawful. Applying the text to a specific incident is for the competent authority.[1]

Is there a fixed penalty for defamation on social media?

The Law does not set a single figure for every case. Defaming others and causing them harm through information technology, and violating private life by misusing camera-equipped phones, both sit in Article 3 with a range up to one year and a SAR 500,000 fine, or either. Article 6 separately imposes up to five years and SAR 3,000,000 for producing, sending or storing material that would affect public order, religious values, public morals, or the sanctity of private life — a distinct set of offences, not an aggravation of Article 3.[1]

Which article is the aggravation provision?

Article 8, not Article 6. Article 8 provides that the imprisonment or fine is no less than half its maximum where the offence is committed through an organised gang; where the offender holds a public office and the offence is connected to it or they exploited their powers or influence; where minors or those in their position are lured and exploited; or where the offender has prior local or foreign convictions for similar offences. It applies to any offence in the Law, including extortion and defamation.[1]

What is the penalty range for hacking an account or leaking data?

Article 5 imposes imprisonment of up to four years and a fine of up to SAR 3,000,000, or either, for unlawfully accessing a system to cancel, delete, destroy, leak, damage, alter or republish private data, as well as for stopping or disabling the information network and for obstructing or jamming access to a service.[1]

Can an offender who reports first be exempted?

Article 11 provides that the competent court may exempt from these penalties any offender who takes the initiative of reporting the offence to the competent authority before it becomes known and before harm occurs. Where the report comes after the offence is known, exemption requires that it lead to apprehending the remaining offenders where there are several, or to seizing the tools used in the offence.[1]

How do I report cyber-extortion, account hacking, or online defamation?

The published channel is Kollona Amn, whose report categories include violation of private life, threats, impersonation, extortion, hacking of social media accounts, and defamation. The steps: open the app, choose the cybercrime report category, select the relevant subcategory, add a description and attachments, then submit. Where the incident also involves financial fraud, a separate service exists through Absher.[2][3]

When should I call an emergency number?

The Unified National Platform publishes 911 as the unified emergency number and 999 for the police. These numbers are for urgent situations requiring immediate intervention; non-urgent matters are reported through Kollona Amn or Absher depending on the type of incident.[4]

Official sources

Source	Article / reference	As of
Anti-Cyber Crime Law — Royal Decree No. M/17 of 8/3/1428H, Bureau of Experts at the Council of Ministers	Article 3 (extortion, defamation, and violation of private life), Article 5 (cancelling, leaking and republishing private data), Article 6 (content affecting public order, religious values and public morals, as amended by Royal Decree No. M/54 of 22/7/1436H), Article 8 (aggravating circumstances), Articles 9 and 10 (incitement and attempt), Article 11 (exemption where the offender reports first), Article 13 (confiscation and site closure), and Articles 14 and 15 (technical support and jurisdiction)	2026-07-25
Kollona Amn — security and criminal reporting platform	Cybercrime reporting service	2026-07-25
Absher — financial fraud reports (Public Security services)	Financial fraud reporting service	2026-07-25
Emergency contact numbers in the Kingdom — the Unified National Platform	911 unified emergency number, and 999 police	2026-07-25

Change log

2026-07-07Legally reviewed and published
2026-07-25Corrected against the primary text and the Unified National Platform: Article 6 was described as covering "aggravated cases" — the aggravation provision is Article 8, and Article 6 is a distinct set of offences; each range is now attributed to its article (3, 5 and 6); Articles 8, 9, 10, 11, 13 and 15 added; the owner-knowledge condition for site closure in Article 13 restored; and the regional split of emergency numbers (911 for certain regions, 999 for the rest) removed as unsupported — the official source publishes 911 as the unified emergency number and 999 for the police — with the Ministry of Interior homepage replaced by the emergency-numbers page

Content on this site is general legal information, not legal advice, and is no substitute for consulting a licensed lawyer. We link you to official sources and do not represent any government body.