Gabriel Rufyiri of OLUCOME reported on 23 October 2026 that 2.4 million euros were siphoned from the BRB in a cyberattack. These stolen funds amount to more than 14.4 billion Burundian francs when calculated at the black market rate. The loss originated from the Central Bank of Burundi during the security breach. OLUCOME continues to monitor the financial impact of the incident on the institution.
Methodology of the Cyberattack
Bank officials identified the mechanism used to facilitate the illicit fund transfers from the institution. The BRB communiqué stated, "Des criminels informatiques ont accédé à un compte d’une banque polonaise partenaire de la BRB, en simulant le paiement d’une facture liée à une commande d’équipements de la Regideso."
Attackers gained unauthorized entry into a partner account held within a Polish financial institution. By manipulating these credentials, the actors initiated fraudulent payment instructions. These simulated transactions were presented as legitimate invoices intended for the procurement of equipment for Regideso. The process allowed the unauthorized movement of assets by mimicking standard commercial payment protocols between the banking partner and the state-owned utility company. Internal reviews at the BRB are currently examining the specific digital vulnerabilities that allowed the actors to circumvent established verification procedures during the transaction process.
Tracing the Stolen Funds
Investigations into the movement of the misappropriated capital indicate that the funds were routed through accounts based in Poland, China, and Hong Kong. Financial authorities are tracking these international transfers as part of the broader recovery effort following the security breach at the Central Bank of Burundi.
Records suggest that the cyberattacks targeting the BRB have been occurring since 2024. These ongoing digital intrusions indicate a sustained effort by malicious actors to identify and exploit vulnerabilities within the national banking infrastructure over a multi-year period.
Parallel security assessments revealed that the Burundi Post office was also targeted by hackers. Officials have not specified the total financial damage linked to the incident at the postal institution, but the event remains under active review alongside the investigation into the BRB. Relevant state departments are coordinating to determine whether the same methods were employed in the attack on the Burundi Post office as those used against the central bank. Data logs from the affected systems are currently undergoing forensic analysis to establish a definitive timeline of the unauthorized activities reported since 2024.
