$4 Million Lost to Cybercrime in Kenyan Bank Hacking Incident

Strategic Insights -

A Kenyan bank lost a staggering Sh517 million ($4 million) after contractors compromised the security system for cards, enabling unauthorised wallet creation and laundering of funds through cryptocurrency. The incident was one of the several cases of cybercrime tracked by Kenya's financial intelligence unit, the Financial Reporting Centre (FRC), over a three-year period to 2023. The FRC report, which withholds the name of the bank and the contractor, highlights the risk posed by third-party service providers to banks' security systems.

Key Takeaways:

  • The bank contracted three merchants to instal and maintain a 3D secure integration system for cardholders, but the contractors altered the system to a 2D secure which did not require One Time Pin (OTP) authentication codes.
  • The contractors initiated customer wallets that required no customer authentication, leading to the theft of $4 million from customer wallets.
  • The funds were diverted and settled into an account of one of the contractors in JKA bank, a code name for the unidentified bank.
  • The FRC says the contractors used the stolen funds to purchase cryptocurrency tether in different exchanges and then transferred the crypto assets to a common USDT address.
  • The stolen funds highlighted the risks posed by third-party service providers to banks' security systems, particularly in cases of unauthorised wallet creation and laundering of funds through cryptocurrency.
  • The FRC also highlighted the need for banks to enhance audits of their staff and third-party businesses contracted for critical operations such as IT systems, cybersecurity, data processing, and payment infrastructure.

Statistics:

  • Sh517 million ($4 million) lost to cybercrime in the hacking incident.
  • Over 14,000 suspicious financial transactions tracked by the FRC over a three-year period to 2023.
  • $445,000 (Sh57.5 million) lost by NCBA bank in a separate case of cybercrime involving a consultant who was contracted to carry out system maintenance and upgrading of the mobile and retail banking platform at the bank's subsidiary in Rwanda.
  • 70 customers in Rwanda initiated 260 transactions resulting in the loss of Sh57.5 million in the separate case.

Sources:

  • Financial Reporting Centre (FRC) report, no date specified.
  • The Daily Nation, "Kenyan bank loses Sh517m to hackers after contractors compromise security system" (no date or publication date specified).
  • Business Daily Africa, "NCBA bank loses Sh57.5m to cybercrime after hiring rogue consultant" (no date or publication date specified).
  • Central Bank of Kenya (CBK), "Speech by CBK Governor on the need for banks to enhance audits of staff and third-party businesses" (no date or publication date specified).