A recent cyberattack on a bank in neighbouring Rwanda has demonstrated how quickly cybercrime can cross national borders, after money stolen in the attack was transferred to Uganda and withdrawn here. Andrew Mubiru, the Uganda Police Force Director of Forensic Services, declined to reveal the name of the affected bank or the amount of money withdrawn in Uganda.
He, however, used the incident to illustrate the growing risks posed by cybercrime as countries increasingly digitise their economies and public services. Mubiru said the attackers targeted a bank in Rwanda before transferring the stolen funds to Uganda.
“Recently, we had an incident that happened in our neighbouring country in Rwanda, where one of the banks was attacked. And the attack was orchestrated by individuals into that financial sector. Funds were sent over to the Ugandan jurisdiction and removed in Uganda,” Mubiru said.
For security reasons, Mubiru did not say whether the people behind the attack had been arrested or whether any of the money had been recovered. He said the Rwandan case demonstrates how cybercrime can move across jurisdictions, leaving investigators in one country dependent on authorities in another to trace money, identify suspects and investigate how an attack was executed.
He warned that the danger could become more serious if a country begins to interpret a cyber incident originating from, or passing through, another country as a deliberate hostile act. “If your neighbour construes that this attack would equate to a kinetic action, you are in trouble,” Mubiru warned. He illustrated the risk using an example of two neighbouring homeowners.
“If you have your home and you have all these fancy fences and everything, but your neighbor decides to keep a big bush, and then the big bush snakes keep on coming up and coming to your area, at a certain point, you may think this person is doing it deliberately,” he said.
Mubiru said the same principle could apply to cybersecurity, where vulnerabilities in one country could eventually pose a security risk to its neighbours. “So a cybersecurity exposure may actually turn out to be a national security risk,” he said. T
he warning comes as Uganda rapidly expands its digital economy. Bank of Uganda Governor Dr Michael Atingi-Ego said an estimated 23 million Ugandans, nearly half of the country’s population, are now online, driving commerce, financial inclusion, education and government service delivery. But he warned that every gain in digital reach also increases exposure to cyber threats.
Atingi-Ego said technology can accelerate Uganda’s transformation, while finance can turn that transformation into investment, production and opportunity. But he said trust is what allows businesses and institutions to participate with confidence, making cybersecurity increasingly important to maintaining that trust.
“Cyber security is increasingly the principal means by which that trust is earned and kept,” Atingi-Ego said. He said cybersecurity is therefore no longer simply an information-technology issue but a question of economic and financial stability.
The country’s digital systems are increasingly interconnected, making a weakness in one part of the ecosystem capable of affecting several others.
“The power of digital technology comes not from individual systems, but from the connections between them. A payment platform that links banks, telecom operators, merchants, and consumers. A digital identity that links citizens to dozens of services at once,” Atingi-Ego said.
He said a vulnerability in a telecommunications network can surface as a crisis in financial services, while a compromised identity credential can open access across the wider digital ecosystem. For the Bank of Uganda, he said, financial stability now depends not only on capital and liquidity but also on the availability, integrity and reliability of the systems through which financial activity flows.
Atingi-Ego said cyber incidents that begin as technical failures can quickly become payment disruptions, cause loss of public confidence and, if not contained, develop into financial stability events. The Bank of Uganda introduced cyber and technology risk-management guidelines in December 2024, requiring supervised financial institutions to strengthen governance, data protection and security controls.
Atingi-Ego said the same level of resilience should extend beyond the banking sector to telecommunications companies, government agencies and other institutions connected to Uganda’s critical digital infrastructure.
According to Uganda Police annual crime reports cited by Atingi-Ego, reported cybercrime cases increased from about 245 in 2023 to 474 in 2024, before falling slightly to 412 in 2025. He said the figures remained nearly double the 2023 level, with financial losses running into billions of shillings each year.
A national assessment by the National Information Technology Authority-Uganda found that roughly four in every ten Ugandan small and medium enterprises had experienced some form of cyberattack.
Mubiru, meanwhile, cited a separate set of figures from cases received by his side of law enforcement, saying the number had risen to about 833 from 129 in 2019. “About 833 cases. This is from just a mere 129 that we are receiving in 2019. The numbers are increasing,” he said.
The different figures point to the growing scale of the threat across Uganda’s digital ecosystem. Mubiru said the financial sector remains a major target because it is where large amounts of money move.
“Everybody is looking at the money. Where is the money? And I checked the other day that actually I can be able to procure an exploit for $400 and that exploit is able to earn me a good billion from Bank of Uganda if I know where to deploy it,” he said. But he warned that the threat is not limited to external hackers.
“The compromise also is from within. The insider threat is real. So, the insider threat for me is the bigger problem as much as we may talk about all this AI and so many things. But this has not spared the government critical infrastructure,” Mubiru said. He said the risk could increase as Uganda digitises more government services and develops strategic infrastructure.
“As we build the oil refineries, as we go digital in government services, we are likely to expose our public sector to more of this threat,” he said. Mubiru also identified business email compromise as a major source of financial losses for Ugandan businesses, particularly those dealing with foreign partners.
“So business email compromise, I think has been flashed here already, is one of the areas where most businesses are losing money. So they do business with their counterparts abroad, but when their emails are compromised, they lose quite a lot of money. And these are the cases we continuously are called on to see,” he said.
Mubiru said the rapid development of artificial intelligence and other technologies is creating new risks around digital identity. He warned that criminals can manipulate people’s identities, voices and other personal characteristics to facilitate impersonation and fraud. “Nowadays, people can even get your identity and manipulate it. They can manipulate your voice. They can manipulate anything about you. So, in other words, our digital identity is at risk,” he said.
The concern is particularly important as Uganda increasingly relies on digital identity for public services and financial transactions. Mubiru also warned about cyberstalking and cyberbullying involving children and called for greater public awareness and accessible channels through which incidents can be reported.
Atingi-Ego said the tools available to both attackers and defenders are changing rapidly, requiring institutions to continuously adapt their security measures. “The tools available to both attackers and defendants are changing in real time,” he said.
He said the changing threat landscape means cybersecurity cannot be treated as a static technical issue. Despite the growing threat, Mubiru said Uganda’s ability to respond is being undermined by late reporting and fragmented institutional responses. Many cyber incidents are reported to the Police only after significant losses have already occurred.
“People are not reporting incidents. Nobody is reporting incidents. Actually, from the banking sector, we receive just the incidents when the situation has gone out of hand,” he said.
Mubiru said some institutions approach the Uganda Communications Commission, others turn to the National Information Technology Authority-Uganda, while some hire private cybersecurity specialists. He said the different approaches can create gaps in the national response. “We need to harmonize across board. So, I would want to see a harmonized approach to some of these cyber security threats that we are seeing. Different sectors approach the problem differently,” he said.
Mubiru also called for stronger cooperation between Uganda and other countries, arguing that cybercrime increasingly requires investigations that cross national borders. The movement of money from Rwanda into Uganda highlights the challenge.
If criminals attack a Rwandan bank, transfer the proceeds to Uganda and withdraw the money here, investigators in Rwanda may need Ugandan authorities to help obtain transaction records, identify accounts, trace suspects and recover assets.
Mubiru said Uganda is already a signatory to the United Nations Convention against Cybercrime, which was launched in Hanoi in 2025, but has yet to complete local ratification. He said Uganda also needs to domesticate the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention.
For law enforcement, he said ratifying and domesticating the conventions is important because they can strengthen cooperation with international partners and improve access to advanced digital and computer-forensics tools. “Currently, we are struggling with our digital forensics and our computer forensics tools to be enhanced, because some of the solution providers globally would ask you, did you ratify the Malabo Convention? And Uganda has not,” he said.
Mubiru said Uganda has made progress in establishing a national cybersecurity framework but still has gaps that need to be addressed. He said the country needs stronger collaboration between government agencies, regulators, law enforcement and the private sector, as well as greater public trust and resilience.
He also called for cybersecurity regulation to extend beyond the financial sector, where the Bank of Uganda has already established stronger requirements. “We need to extend the regulation just beyond finance because what is happening is that in the financial sector, there are a lot of regulations. Bank of Uganda is leading the way. But in other areas, we don’t see much of this regulation coming through,” he said.
Mubiru’s concerns reflect a broader challenge identified by Atingi-Ego: Uganda’s digital transformation is advancing rapidly, but resilience must advance with it.
Atingi-Ego said institutions should not measure preparedness by their ability to prevent every cyber incident, but by their ability to withstand attacks, recover from disruptions and learn from them. He urged institutions to build security into digital systems from the beginning rather than treating it as an afterthought. “Build security in, do not bolt it on,” Atingi-Ego said.
Mubiru recalled a description given to him by a cybersecurity solutions provider during an engagement in Thailand, who likened many African countries to a glass house with curtains. He said the analogy reflected the continent’s growing digital exposure and the weaknesses that remain in its cybersecurity defences.
“The attack surface is increasing. We have a national cyber security strategy and it is being implemented as well. So our pressure points are very clear,” he said.
Mubiru said Uganda must therefore move beyond simply creating digital systems and focus on making them resilient enough to withstand increasingly sophisticated threats. He warned that the country’s digital infrastructure could otherwise become a pathway through which criminals target Uganda and its neighbours.
“I sit in a desk where I only receive the complaints and have to do the work and just take criminals to court. But the criminals are running circles around us. And with the onboarding of AI, I think about to close the windows,” he said. He called for stronger defences around Uganda’s digital infrastructure. “So, this glass house with the very nice fancy curtains, governor, ED, I think we need to begin building some brick walls around that fancy house,” Mubiru said-URN. Give us feedback on this story through our email: kamwokyatimes@gmail.com
