The Bank of Uganda governor told delegates at the inaugural National Cybersecurity Conference on Tuesday that cybersecurity should be treated as core national infrastructure rather than an IT problem.
Cybersecurity is the practice of protecting computers, networks, and data from digital attacks. On the other hand, Cybercrime is the illegal use of technology to commit fraud, steal data, or damage systems.
Michael Atingi-Ego said that cybersecurity has become a macroeconomic issue and not merely a technical one, that resilience must be practiced rather than filed away as policy. He said that trust, once broken, costs far more to rebuild than to protect in the first place.
“Uganda’s digital transformation will succeed only if finance, technology and trust advance together. Technology can accelerate transformation. Finance can turn that transformation into investment, production and opportunity. But trust is what allows citizens, businesses and institutions to participate with confidence, and cybersecurity is increasingly the principal means by which that trust is earned, and kept,” the governor said.
“Let me be plain about why this matter to a central bank. Trust is not a soft virtue added on top of sound economics; it is infrastructure, as real, and as load-bearing, as a road or a power line. Remove it, and every investment we make in connectivity, financial inclusion and digital government sits on ground that can give way without warning,” he said.
Citing the Uganda Police Force’s Annual Crime Report, he noted reported cybercrime cases nearly doubled between 2023 and 2024, then eased only slightly the following year.
“The Uganda Police Force’s Annual Crime Report records that reported cybercrime cases nearly doubled, from 245 in 2023 to 474 in 2024, a rise of over 93 percent, before easing only slightly to 412 in 2025, still close to double the 2023 level, with associated financial losses running into billions of shillings each year,” he told the conference.
Where the speech gets tested
In November 2024, the Bank of Uganda’s own systems were compromised in an incident that saw about UGX62 billion (roughly $16.8 million) diverted through fraudulent international payments, an attack later attributed to a hacking group.
Nine Ministry of Finance officials, including senior Treasury personnel, were subsequently detained in connection with the breach. Then, in the early hours of May 4 this year, the central bank’s Kampala Road headquarters was physically broken into, with intruders making off with seven laptops, a CCTV server and an internet router after reportedly spending close to three hours undetected inside the building.
None of that makes the governor’s argument wrong. If anything, it makes his own institution the clearest illustration of it.
“No serious institution can assume it will never face an incident. The more useful question is: how well prepared are we when prevention fails? That is the discipline of resilience, the capacity to anticipate, withstand, detect, respond, recover, and, critically, to learn. We do not design financial systems on the assumption that shocks will never occur; we hold capital buffers and run stress tests precisely because we know they will. Cyber resilience deserves the same rigour,” he said.
Recent industry reported cases
Reports show that Cyber criminals successfully breached the core digital framework of Finance Trust Bank over a five-day period. The perpetrators siphoned UGX 6 billion, swiftly dispersing the funds through more than 130 localized MTN and Airtel mobile money accounts to evade tracking. Multiple suspects were subsequently remanded to Luzira Prison.
A security loophole within Pegasus Technologies, a major third-party consumer finance aggregator led to a massive crisis across the telecommunications. Hackers weaponized an estimated 2,000 SIM cards to manipulate bank-to-wallet transfers, stealing at least $3.2 million (UGX 11 billion) and forcing MTN and Airtel to temporarily suspend shared operations.
Fraudsters compromised the credentials of loans officers at upcountry commercial bank agent branches to gain unauthorized backend access. They manipulated the establishment’s Bill Pay System and agent banking applications to siphon UGX 5.5 billion intended for utilities and school fees.
Our digital future will be defined not only by how connected we become, but by how securely we remain,” Joyce Nabosa Ssebugwawo, Minister of State for ICT, said.
