Three months after listing the South African courier, the group published supplier, HR, lease and finance documents and cut its asking price in half. The Courier Guy says no ransomware ran, no customer or parcel data was taken, and it has reported the incident to the Information Regulator.
Read at MyBroadband ↗Analysis of the June ransomware attack on MIP Holdings, in which reused employee credentials gave attackers 400,000 records from a Jira help desk. The Gentlemen gang later leaked Hollard funeral policyholders' data, and PoPIA puts notification duties on each insurer, not the supplier.
Impostor social media pages, links and text messages pose as the ministry to collect national ID photos, personal data and fees for its irregular-worker grants and fake jobs. The ministry says all its services are free and it will pursue legal action.
Suspects held three fake National Identification Numbers and Bank Verification Numbers each, linked to dozens of accounts, with 14 SIM cards and nine ATM cards seized. Police froze N22m and say two alleged ringleaders remain at large.
At the Data Protection Africa Summit in Lagos, NDPC chief Vincent Olatunji told firms to treat compliance as business culture and said partnership with the regulator is no shield. He put certified data protection officers at over 10,000, up from under 1,000.
Two men posing as customers took televisions and air conditioners from a Bauchi trader after sending a forged payment notification. Police arrested one suspect, recovered all the goods in Bauchi and Jos, and are hunting his accomplice.
The CDP says AI-faked voices and videos are being used to trick relatives and colleagues into sending money or data, and reminds the public that a person's voice and image are protected personal data under Senegalese law.
The Army says @HQNigerianArmy is back under official management after unauthorised access attempts on 29 August. The Defence Headquarters' X account was hit by a similar attack earlier that month and recovered within days.
A Nigerian tech publisher alleges several unnamed fintechs lost billions of naira to attacks since October 2026, while lender Lendsqr says it blocked attempts using stolen developer tokens. The losses are unverified, and the episode shows how little intelligence Nigerian fintechs share.
A signature-verification bug in IBM API Connect 10.0.8 and 12.1 lets unauthenticated attackers bypass login; sibling flaws include hard-coded admin credentials and remote code execution. Banks and telcos running the API gateway should patch now. No exploitation reported.
An authorisation bypass in Entra Device Registration, rated CVSS 10.0, lets an unauthenticated attacker elevate privileges over the network. Entra is a cloud service, so Microsoft applies the fix, but admins should review Microsoft's advisory. NVD lists no exploitation yet.
At a UNICEF-backed national forum in Tunis, the family ministry said it is preparing a bill on protecting children online and a national digital child-protection plan to 2028. A survey of 3,500 teenagers found 10% had suffered abuse online.
A House committee chair says the three bills will be enacted after the elections, with a national security architecture setting baseline standards. The review follows AI-driven fraud, the CAC and Remita data exposures, and N25.85bn in e-payment fraud losses in 2025.
Equity Bank says a former salary-processing manager used his user credentials to push disguised payroll transfers from the general ledger over eight months, with funds moved through third-party accounts and into cryptocurrency. The High Court ordered the crypto converted and held in escrow.
The Interior Ministry's cybercrime unit says the suspect advertised bladed weapons online, took payment transfers and then switched off his phone without delivering. He admitted the scheme and faces legal proceedings.
Central Bank of Kenya figures show card fraud losses more than doubled to Sh645m, online banking and internet scam cases climbed, and banks recovered only about 6% of targeted funds, down from 19% a year earlier.
The private member's bill proposes fines of up to KSh500m or 10% of global turnover, plus jail for executives, with the Communications Authority enforcing age assurance and parental authorisation on Facebook, TikTok, X and others.
A World Wide Worx poll of 200 South African enterprises finds over half suspect or have seen AI-generated phishing, voice cloning or deepfakes, yet under 28% have upgraded liveness or face-matching controls and most lack tested response plans.
The DCSSI, Senegal's national cybersecurity authority, signed an agreement with SOS Children's Villages to train staff, raise awareness and help humanitarian NGOs harden their systems, with a focus on protecting children online.
Nigerian police say some small SIM-registration outlets collect customers' NIN and personal details, then register other numbers that are sold to criminals. Victims risk being investigated for crimes committed with those lines and are urged to check which numbers are linked to their NIN.
Cape Town booking site LekkeSlaap says an intruder accessed its calendar-sync system and took some guests' names, emails, phone numbers and booking references, but no card or ID data. It warns of phishing posing as hosts and says the case is unrelated to the NightsBridge breach.
A poll of 1,864 online students in 18 countries including South Africa found phishing links, fake apps and bogus courses were the top problems, with 29% of those affected losing money. It shows the risk of expanding online education without basic protections.
A KnowBe4 Africa column draws on Interpol's latest African Cyberthreat Assessment, which puts reported cybercrime losses on the continent at $484m in 2025 and names South Africa the top target for ransomware, DDoS and phishing. It argues staff fear of blame is the bigger weakness.
Attackers used AI-driven techniques in the Chainalysis breach and the $6.3bn Binance heist, while Nigeria, second in global crypto adoption, still has no AI law. The NDPC and NITDA are reviewing data and cybercrime rules as AI-driven attacks on Nigerian finance reportedly rose 150%.
The 'Africa's Cybersecurity Landscape 2026' report on Nigeria, Kenya and South Africa finds AI used in more than 55% of observed attacks, from automated phishing to deepfakes. Weak currencies and dollar-priced security tools are pushing up defence costs for African firms.
The Gombe State coordination unit of the Nigeria for Women Project Scale-Up says a link promising grants is not its own and warns people not to enter personal or bank details, share verification codes or pay anything in response.
The South African channel manager says a code flaw let an attacker, believed to be an AI agent, pull future booking summaries across partner channels on 2 November. Guests face WhatsApp reservation-hijack and phishing attempts using real dates and booking numbers.
At the Africa Cyber Defence Forum in Nairobi, ICT minister William Kabogo named operationalising the new agency and its operations centre as a top priority, with closer coordination with NC4, KE-CIRT and the data commissioner, as the CA logged 2.6bn threat events in Q3.
Ghana's Data Protection Commission says the 2012 Act is being revised to cover biometrics, location data, cross-border transfers and AI, with stiffer fines. Its head also urged African states to keep copies of health, financial and energy data in-country.
The US firm's new Abidjan centre pairs a security operations centre with an incident response team and training programmes, aimed at helping Côte d'Ivoire and other African governments detect and handle cyberattacks.
Google, TrendAI and partners dismantled a botnet preloaded into the firmware of 1.3 million TV set-top boxes worldwide. The malware turned household connections into residential proxies for ad fraud and identity theft, and Google has banned the responsible manufacturer.
The state-owned airline says intruders reached internal systems with staff and corporate records on 3 November, while booking and flight operations were unaffected. It has not said how many people are affected or whether a ransom was demanded.
After FNB's R1m POPIA fine, the Information Regulator's enforcement notice also found the bank unlawfully gathered personal data from newspapers and other sources it treated as public. FirstRand's policy lists third-party data used to assess loan risk.
Speakers at the Lagos summit said diverging data protection laws, and regulators reading similar laws differently, create uncertainty for firms moving personal data between African countries under the AfCFTA Digital Trade Protocol, and called for harmonised rules.
Days after automated traffic cameras went live, police told drivers to trust only notices from the GPS-MTTD sender ID, check the ticket photo and plate, and pay via the NIB portal or *710*0#, never to personal mobile money numbers.
The CSA says reported cyber incident losses rose more than ninefold from GH¢22.5m a year earlier, with social engineering behind most cases. It plans a zonal office in Tamale to improve reporting and response in the north.
Minister Leon Schreiber told Parliament that 35 identity theft allegations were investigated this year and 17 officials accused of unlawfully processing ID applications were referred for discipline and prosecution. The paper green ID book remains the main target.
A Nigerien ministry team is studying Burkina Faso's national SOC, running since April 2025, and its legal framework during a week-long visit, as Niger plans a centre to monitor state systems and flag incidents.
The ICT agency's head told fintech firms gathered at Mbankomo that its security audits are meant to find weaknesses in digital financial services and keep user trust as the sector grows.
A technology consultant says motorists cannot easily tell genuine Traffitech-GH violation notices from scam texts. Police say real notices use the sender ID GPS-MTTD and that fines are paid only through the government portal.
The memorandum of understanding commits both organisations to help African states build more resilient digital ecosystems, with a focus on cybercrime response, data protection and capacity building.
The sixth edition of the forum will bring regulators, officials, executives and investors to Benin to discuss digital trust and cybersecurity in the age of artificial intelligence.
Binance's initial investigation traces the heist to a poisoned Homebrew download in June and a fake recruitment 'assignment' in September, then abuse of an internal AI tool and a deployment token. About $2.85bn has been frozen and 98% of user assets replenished.
The central bank says the loan apps breach Ghana's digital credit directive and violate customer data privacy and consumer protection rules. Banks and payment providers were told not to process transactions for them.
As federal relief payments begin, the fintech says it will never ask for a PIN or OTP to process them and tells customers not to pay agents or click unverified links. Eligibility can only be checked in the OPay app or by USSD.
The Deloitte and Jeune Afrique financial industry barometer, drawn from leaders in 20 African countries, finds electronic fraud is now the main operational brake on regional growth, with many lenders retreating to home markets and few connected to PAPSS.
Ohene Kwame Frimpong, MP for Asante Akyem North, was arrested at Schiphol in May on a US request tied to romance fraud and money laundering. Two bail applications have failed and a Dutch court will hear the extradition case on 18 November.
Kaspersky says intrusions seen in September and October used an open-source AI agent to automate reconnaissance, credential theft and data exfiltration, reaching domain admin within days. Schools and universities in Africa and Latin America were among the victims.
Yazi's 2026 Global Digital Fraud Study finds phone calls are the top entry point for fraud in South Africa, with WhatsApp use far above the UK's. Most losses come from patient investment or job scams built over weeks, not sudden panic, so detection models should watch slow patterns.
Interior CS Kipchumba Murkomen chaired the inaugural board of the agency created by executive order in July. It will audit and certify critical infrastructure and run a national operations centre, but the law has not yet defined how it fits with existing bodies.
ACAMB, the body for bank communication professionals, issued the alert after a fact-check traced an SMS impersonating several banks to a fake login page built to harvest BVNs, card details and PINs. It says no Nigerian bank asks for an OTP, PIN or BVN via a link.
A US State Department official met the EFCC, NSA office and police in Abuja to widen cooperation on cyber-enabled fraud. The US embassy says the FBI and EFCC have completed 41 extraditions since 2022, five of them this year.
Three CVSS 9.8 bugs in the CWP hosting control panel chain an authentication bypass needing only a valid username with file-write and command-injection flaws. Hosting providers running CWP should upgrade to 1.16 or later. No exploitation has been reported so far.
An 18-year-old arrested in an EFCC sting on 21 suspected internet fraudsters in Lekki pleaded guilty to laundering $800 from a fake-lottery scam. He posed as an American woman on messaging apps and cashed out the victim's gift cards through a card-trading app.
Nigeria's identity commission raided unofficial enrolment points in Gwagwalada and elsewhere, seizing equipment used for illegal NIN registration and record changes. It says such operators extort applicants and risk compromising the national identity database.
The National Financial Ombud says criminals posing as promoters ask shoppers to scan their faces, then use the biometric check to register their own device on the victim's digital banking profile. Fraud cases closed by the ombud rose 27.5% in the first nine months of 2026.
The 22-year-olds used fake dating and social media profiles to defraud victims in Ohio and 24 other states between 2024 and 2026, with part of the money sent to Ghana. The FBI worked with Ghana's police and Cyber Security Authority on the case.
Chainalysis says the $6.3bn stolen from Binance is being cycled through thousands of scripted transactions to hide its trail. Binance has restored withdrawals in phases, with Binance Africa saying the losses were covered from the exchange's own reserves.
Network Platforms told ZANOG that DDoS incidents against SA internet infrastructure rose from 10,000 to 22,000, with peak volume up from 300Gbps to 1.1Tbps. Some attacks ran for over 72 hours, using carpet bombing and DNS amplification.
Nation reports several Kenyan cases where people joined or set up WhatsApp funeral groups, collected M-Pesa contributions from mourners and vanished, including one fake death staged to raise money.
Rights group SERAP wants the NDPC to forensically examine INEC's systems and rule whether the questionable voter records, which INEC has acknowledged, amount to a personal data breach under the 2023 Data Protection Act.
The FBI thanked Nigeria's EFCC for its part in Operation Artemis, which led to two Nigerian suspects being arrested and extradited to the US in August to face charges over sextortion of minors.
A CVSS 9.8 SQL injection bug in the advanced search API of Apache Fineract, the open-source core banking system behind many African microfinance and fintech deployments, affects versions up to 1.15.0. Operators should upgrade to 1.16.1. No exploitation has been reported yet.
South Africa's Government Communications and Information System says suspicious activity on 24 October compromised its e-recruitment platform. It has reported the incident to the Information Regulator and police and warned applicants of phishing risk.
Emuobosan Emanuella Hall was sentenced in January to eight years in the US for laundering money from a multi-victim romance scam, but failed to report to prison in March. The FBI says she has ties to Delta State and Abuja.
Isaac Oduro Boateng ('Kofi Boat') and Inusah Ahmed ('Pascal') admitted roles in a syndicate that defrauded US victims of over $100 million through romance scams and BEC, and each faces up to 20 years in prison.
Nigeria's EFCC handed N114 million back to a microfinance bank after tracing money taken from a hacked customer account in 2024. One suspect was arrested and the hunt for others continues.
Binance paused withdrawals after attackers linked to North Korea allegedly stole about $6.3 billion (R104.7 billion) in crypto. South African users confirm they cannot move funds while the exchange responds.
NDPC head Vincent Olatunji said the commission has issued over 20 major remediation orders and named more than 1,900 non-compliant organisations, though it did not name the breached firms or the penalties imposed.
The Interior Ministry said the international company that streams ads to the digital screen was breached, and the same footage appeared on its screens in several countries at once. The firm halted broadcasts while it dealt with the intrusion.
Prosecutors say fake college enrolments in stolen names collected federal aid refunds, two of those charged are Kenyan, and over $750,000 in crypto was seized. Kenya's DCI and Asset Recovery Agency assisted.
The US Labor Department's inspector general lists Onoriode Ezewu, believed to be in Nigeria, as wanted for laundering proceeds of over $1m in unemployment claims filed with stolen identities.
Orange Cyberdefense counted 3,111 internet-facing Plex servers in SA vulnerable to an actively exploited flaw chain allowing code execution. Home users, including remote workers, should update past 1.43.3.10861.
A Cairo lawyer has asked the public prosecutor to trace fraudsters who posed as him online and took EGP 22,000 from a woman via InstaPay for an Umrah visa that never existed.
At a webinar on Joint Standard 2 of 2024, the FSCA said fund boards must oversee providers' cyber controls, demand clear incident-notification timelines and report material incidents within 24 hours.
28% of 50 South African security decision-makers named deliberate workarounds by staff as their top human cyber risk, the highest of 13 countries, against 12% for social engineering. Only 14% of SA firms reached the study's top maturity level.
Nigeria's IT agency now checks ministries, departments and agencies for DNSSEC as part of its security assessments and wants all .gov.ng websites to adopt it, aiming to harden government domains against DNS spoofing.
A Yazi study of SA and UK consumers found South Africans lose money to scams about three times as often as UK respondents, and 75% of SA victims recovered nothing, despite most knowing about AI voice cloning.
A Soweto man faces charges including murder after a 17-year-old victim of the alleged sextortion scheme took his own life; US investigators assisted the South African police.
The communications regulator's draft amendments target a loophole fraudsters use to take over victims' mobile numbers and, with them, their banking one-time PINs.
The ICT ministry's new framework covers how government data is managed, shared and secured.
The IPDCP is running outreach sessions in the run-up to Togo's first national personal data protection day on 29 October in Lomé.
The National Communications Authority and Mogadishu University launched the forum to build local cyber skills and capacity.
Two flaws in Chrome before version 156.0.8078.73 (also CVE-2026-118337) let a crafted page break the browser's same-origin rules. All Chrome users and IT teams should update; no active exploitation is reported.
The Communications Authority of Kenya says system attacks made up most of the detected events between July and September, and blames unpatched systems, low phishing awareness and criminals' use of AI for the rise.
Kenya's largest telco says in its sustainability report that it detected about 1.25 billion intrusion attempts and investigated over 130,000 security events during FY26.
The infringement notice follows a flaw in FNB's app that exposed 88 home loan applications to other customers.
Vodacom, MTN, Cell C and Rain told MyBroadband their systems were unaffected by the two critical PHP vulnerabilities leaked ahead of disclosure.
The AU's specialised technical committee on communications and ICT gathered ministers in Gabon to discuss continental cyber and AI policy.
Officials, security practitioners and researchers meet in Nigeria's capital on 27 and 28 October, with AI-driven threats high on the agenda.
Law enforcement and private partners including Binance targeted online scam networks; Ghanaian police arrested 19 near Accra, seized 303 devices and identified 117 trafficking victims, and over $11m was flagged for possible freezing.
Absa says customers who share credentials with an AI assistant could be held liable for losses; local banks are blocking outside agents for now.
Félix Tshisekedi told the Council of Ministers that public digital infrastructure must be audited to protect government data and services.
Staff are adopting AI assistants and agents without IT's knowledge, opening new paths to company data as attacks on the continent grow.
The Interpol-led Operation Serengeti targeted cybercrime and fraud groups, including Black Axe, across several African countries.
Fraudsters posing as courier companies use payment requests and fake tracking links to steal money and card details from online shoppers.
Attackers claim to have taken 1.6 million records from the insurer that covers mining and steel workers. The claim has not been independently confirmed.