FOLLOWING a cyberattack that affected the Central Bank of Lesotho (CBL) on Monday this week, all interbank and international payments via Lesotho are currently unavailable.

Although the CBL could not be drawn the give the full details of the attack, it, however, confirmed in a statement that it experienced a “cyber-security incident” on Monday December 11.

The bank further showed that it has suspended some of its systems to prevent further infiltration.

It said it is working around the clock to restore the systems, assuring the public that it has not suffered financial or any other losses as a result of the attack.

In a joint statement released on Wednesday, the Bankers Association of Lesotho (BAL) and the Central Bank of Lesotho (CBL) addressed the issue of the National Payments System Downtime, acknowledging its impact on inter-bank transactions within the country.

“These are payments and transactions that would normally flow from one bank to another,” the statement highlighted.

It also stated that technical teams from the CBL as the regulator and the banking industry as a whole are working tirelessly to resolve the issue, adding that the nation will be notified as soon as the system is back in operation.

The statement also said CBL and BAL members have now agreed to institute business continuity processes and measures as alternative ways to facilitate payments and transactions between all banks.

“The Central Bank of Lesotho will continue to update all Basotho and users of the financial payment system on these developments,” the statement stated.

“Consequently, some payments may be delayed while the Bank works on getting the systems back to normalcy,” it stated.

In a follow-up statement on Wednesday, the CBL acknowledged the outage of its National Payments System.

“[This] has made it impossible for all local banks to honour inter-bank transactions in the country.”

It explained that these are payments and transactions that would normally flow from one bank to another.

“Technical teams from the Central Bank of Lesotho as [well as] the Regulator and the banking industry as a whole are working tirelessly to resolve the issue and the nation will be notified as soon as the system is back in operation,” it said.

“The CBL and BAL Members have now agreed to institute business continuity processes and measures as alternative ways to facilitate payments and transactions between all banks.”

In November, National News reported that the biggest bank in China ICBC was hit by cyber-attack, the incident, which forced the Chinese lender to use USB sticks to carry out trades, is believed to have been carried out by Ransomware Group Lockbit which is becoming more frequent and sophisticated, and financial services organizations are prime targets for cybercriminals.

The attack, which was first reported by the Financial Times, was launched against Beijing-based ICBC's financial services unit and is suspected to have been carried out by underground organisation LockBit, one of the active ransomware groups globally, Bloomberg reported, citing sources.

ICBC Financial Services confirmed the attack on its website, saying it had “resulted in disruption to certain FS [financial services] systems”.

According to Crowe, a public accounting, consulting, and technology firm that combines deep industry and specialized expertise with innovation, there are ten most frequent cyber-attacks in 2023 which  includes;

1. Ransomware attacks

Ransomware attacks are becoming more frequent and sophisticated, and financial services organizations are prime targets for cybercriminals. These attacks can cause serious harm to organizations, including sensitive data loss and operational disruption. Additionally, some organizations are forced to pay millions of dollars in ransom payments to threat actors.

2. Cloud security threats

Cybercriminals are taking advantage of financial services companies’ increasing embrace of and reliance on cloud services, so cloud security controls are critical. Once threat actors gain entry to these cloud services, they target sensitive information, which they then alter, steal, destroy, or use to gain reverse access to the organizations’ internal networks

3. Artificial intelligence and machine learning attacks

As fast as financial services companies are figuring out ways to apply artificial intelligence (AI) and machine learning to benefit their businesses, cybercriminals are also devising ways to weaponize these tools for more efficient cyberattacks. The automated and persistent nature of these attacks can make them especially hard to detect and defend against.

4. Insider threats

Employees, vendors, and other individuals who have access to sensitive information can pose a risk to an organization – whether they intend to or not.

5. Phishing attacks

Phishing attacks trick individuals into disclosing sensitive information such as login credentials, financial information, and personal details. Increasingly sophisticated techniques and messaging have made these phishing attacks more effective and persuasive than ever.

6. Legacy system attacks

Legacy systems are systems that have reached an end-of-life or end-of-support stage from the vendor, making them vulnerable to security threats. These older systems often lack defenses against the latest and most sophisticated threats to cybersecurity in banking, so organizations that use legacy systems risk security breaches and data loss.