Mobile payment service providers and digital payment systems are counting billions in lost cash after hackers hit a third-party payment technology company in Uganda last week.
In a joint statement signed by MTN, Airtel and Stanbic Bank the three companies said there had been a system incident in which hackers had accessed systems of a third party service provider, thus impacting all bank to mobile money or wallet transactions.
The hacking of a bank in Uganda, which is believed to have started in early October and gone through the weekend, forced mobile money service providers to suspend bank to mobile money or wallet transactions.
According to Michael Tumusiime, lead security engineer at cyber security firm Checkpoint East Africa, such incidents are more common in Africa compared to the rest of the world, with an increasing trend of cryptominers and mobile attacks.
Check Point’s African Trends report shows that an organization in Africa is being attacked on average 1,293 times per week in the last 6 months, compared to 485 attacks per organization globally.
“These attacks can be prevented if organisations perform contextual analysis of API/Web requests, even from trusted sources,” says Tumusiime. “Create atomic segments around critical assets and scan for known and unknown attacks.”
This is essentially all part of the due diligence that businesses need to bear in mind in order to protect themselves and their customers. The most targeted countries in Africa are Angola at number one, Cameroon, Ghana, Kenya and Mauritius, in that order.
See Also >> Insiders Remain Biggest Threat to Company’ Security
The hacking of a bank in Uganda, which compromised Uganda’s mobile money network, plunged the country’s telecoms and banking sectors into crisis.
The 3rd October hack was a result of a security breach on a consumer finance aggregator, Pegasus Technologies, which mainly affected bank to mobile wallet transfers, according to an Oct. 8 statement by MTN Uganda, the country’s largest mobile phone company. Kampala-based Pegasus Technologies provides financial and billing solutions for various companies including all the affected entities.
At least $3.2 million (Ksh320 million) is estimated to have been stolen in this latest incident with some reports quoting a much higher figure. The hackers used around 2,000 mobile SIM cards to gain access to the mobile money payment system, according to local papers. They then instructed the banks to transfer millions of dollars to telecommunication companies who then paid out mobile money to these different SIM cards across the country.
hackers used 2,000 mobile SIM cards to access the mobile money payment system.
MTN Uganda and Airtel Uganda, suspended mobile money service transactions between their networks, indefinitely, following what they termed as an “unprecedented technical challenges” in a joint statement signed by their respective chief executive officers. The services are yet to be restored.
More than $20 billion worth of transactions was channeled through the mobile money system in 2019, according to Bank of Uganda, the country’s central bank. MTN alone has over 11 million subscribers and an 80% market share of mobile money transactions in the East African country.
Swapping SIM cards
According to MTN Uganda, only transactions via Stanbic Bank Uganda, MTN to Airtel and Sendwave, a cross-border payments service operating in six African countries including Kenya, Uganda, Tanzania, Ghana, Nigeria, Senegal, and Liberia are affected.
The Uganda Police Annual Crime and Road Safety Report of 2019 showed more than 41 billion Ugandan Shillings ($11m) was lost to criminals through cyber crimes including swapping SIM cards and hacking digital financial accounts last year.
