Bank of Uganda Governor Michael Ating-Ego has warned that cyberattacks targeting the country’s increasingly interconnected digital system. He says cyberattacks could escalate from technical disruptions into financial stability crises, threatening payment systems, businesses and public confidence in the economy.
Ating-Ego said cybersecurity has become a national capability rather than a responsibility for individual institutions, as financial institutions, telecommunications companies, technology providers and government services become increasingly dependent on interconnected digital infrastructure.
He was speaking at the inaugural National Cyber Security Conference organised by the Uganda Communications Commission, bringing together regulators, security agencies, financial institutions, telecommunications operators, technology companies, academics and other cybersecurity stakeholders.
Ating-Ego said Uganda’s growing digital footprint means that the country must now consider cybersecurity as part of its economic resilience. “Trust is not a soft virtue added on top of sound economics. It is an infrastructure as real and as load-bearing as a road or a power line. Remove it and every investment we make in connectivity, financial inclusion and digital government sits on that ground can give way without warning,” he said.
He said the increasing dependence on digital systems means cybersecurity can no longer be treated as an information technology issue. “That’s why we treat cyber security this morning not as an IT agenda item but as a macroeconomic one,” Ating-Ego said.
Uganda currently has an estimated 23 million people online, with digital platforms increasingly supporting commerce, financial inclusion, education and government service delivery. The country’s Digital Transformation Roadmap for 2023/24–2027/28 also targets wider digital access, including 90 percent broadband coverage and 90 percent of citizens accessing e-services online by 2040.
Ating-Ego said every increase in digital reach also increases the country’s exposure to cyber threats. Uganda Police annual crime reports, he said, show that reported cybercrime cases increased from about 245 in 2023 to 474 in 2024, representing an increase of more than 93 percent, before declining to 412 in 2025.
He said the attacks continue to cause financial losses running into billions of shillings each year, while a national assessment by NITAU found that roughly four in every ten small and medium enterprises had experienced some form of cyberattack.
Ating-Ego said the greatest danger is no longer confined to attacks on individual institutions because Uganda’s digital economy is becoming increasingly interconnected.
“The power of digital technology comes not from individual systems, but from the connections between them. A payment platform that links banks, telecom operators, merchants and consumers. A digital identity that links citizens to dozens of services at once. A cloud infrastructure that links many institutions to common providers,” he said.
“That interconnectedness creates enormous value, and it’s also precisely how disruption works. A vulnerability in a telecommunications network can surface as a crisis in the financial services. A compromise in one identity credential can open doors across the entire ecosystem.”
For Bank of Uganda , Ating-Ego said, this interconnectedness has changed the way financial stability risks must be understood. “Financial stability has always depended on capital liquidity. It now depends equally on availability, integrity, and reliability of the systems through which financial activity flows,” he said.
He warned that a cyber incident that begins as a technical failure could rapidly develop into a wider economic problem. “Our supervisory work looks beyond individual balance sheets to system-wide vulnerabilities and interconnections, precisely because cyber incidents that begin as a technical failure can, within hours, become a payment disruption, a loss of confidence, and if we are not prepared, a financial stability event,” Ating-Ego said.
The Bank of Uganda introduced cyber and technology risk management guidelines in December 2024 requiring supervised financial institutions to strengthen governance, data protection and security controls, backed by supervisory enforcement.
Ating-Ego, however, said regulatory compliance alone would not make institutions resilient to cyberattacks. He urged financial institutions and other organisations to test their ability to continue operating when systems fail or when several institutions are attacked simultaneously.
“The more useful question is, how well prepared are we when prevention fails? That is the discipline of resilience, the capacity to anticipate, withstand, detect, respond, recover, and critically, to learn,” he said.
“We do not design financial systems on assumptions that shocks will never occur. We hold capital buffers and run stress tests precisely because we know they will. We know that these cyber securities therefore deserve the same rigor.” he revealed.
He challenged institutions to consider what would happen if their primary systems failed, a key technology provider became unavailable for a day, or several institutions were attacked at the same time.
“What happens if our primary system fails? If our key technology provider is unavailable for a day? If several institutions are hit simultaneously, who decides, who communicates, who coordinates, and how quickly can we restore what matters most?” he asked.
“A continuity plan nobody has rehearsed, a backup nobody has restored is not yet a capability. It is a hope written down on papers. These are the questions that separate the prepared from the merely compliant.” he noted.
He suggested the need for stronger sharing of threat intelligence, coordinated responses to cyber incidents and joint exercises involving institutions across sectors.
He said the cybersecurity requirements imposed on banks should not remain confined to the financial sector because telecommunications companies, government agencies and utility providers are all connected to the same digital ecosystem.
“The rigor we now require of banks under our cyber and technology risk management guidelines should not remain a banking sector achievement alone. Telecommunications, government agencies, and utility providers all have good reason to speak the same language of security, even where regulatory mandate that governs them differs,” he said.
Ating-Ego said Uganda should also stop viewing cybersecurity as an obstacle to technological innovation.
“There’s sometimes a temptation to frame our choice as one between security and innovation. To me that is wrong. The real choice is between innovation that is trusted and an innovation that is fragile. Between growth that compounds over years and growth that can be halted by a single avoidable shock,” he said.
“Security, properly understood, is not the tax we pay for innovation. It is one of the conditions that makes innovation sustainable.”
He urged institutions to adopt a “security by design” approach, incorporating security, privacy and responsible governance into digital systems from the beginning rather than trying to fix vulnerabilities after deployment.
“Whether we are building a payments platform, a digital identity system, or deploying artificial intelligence in public services, security, privacy, and responsible governance belong in the design from the very first day. Not the review that follows after something has gone wrong,” he said.
Ating-Ego said cybersecurity must ultimately become a leadership responsibility, requiring boards and senior executives to take responsibility for the security and resilience of their organisations.
“Cyber security is no longer solely the responsibility of ICT departments. It is a boardroom issue, an executive leadership responsibility, and increasingly a matter of national policy,” he said.
UCC Executive Director Nyombi Tembo agreed with the Bank of Uganda Governor that the country’s communications sector still faces significant cyber threats despite a decline in reported malware infections.
He reported that malware infections declined from approximately 1.59 million in 2024 to 1.41 million in 2025, but the sector’s overall security rating remained in the basic security category, indicating elevated risk.
He revealed that the country is experiencing mobile malware, ransomware, denial-of-service attacks, vulnerable web infrastructure and increasingly sophisticated phishing and impersonation, including attacks involving artificial intelligence.
Nyombi-Tembo called for faster sharing of threat intelligence and closer cooperation between government agencies, regulators, security agencies, telecommunications operators, financial institutions, academia and cybersecurity practitioners.
“Cybersecurity must not be something we add to digital transformation after the infrastructure has been built. Cybersecurity must be part of the infrastructure itself. Actually, it must be a culture,” he said. According to the UCC boss, Uganda’s digital transformation will only be meaningful if the systems connecting citizens, businesses and government services can be trusted.
Their concerns come as Uganda continues to expand digital financial services, online government services and other interconnected technologies, making the resilience of the digital ecosystem increasingly important to economic activity and public confidence-URN. Give us feedback on this story through our email: kamwokyatimes@gmail.com
