In September 2024, Uganda sent payments to repay its loans to the World Bank and the African Development Bank. According to prosecutors, more than $14 million ended up with companies in Tokyo and London instead. The headlines blamed hackers. Investigators later said it was an internal payment fraud.
▶️ Subscribe to Elgon Web Hosting on YouTube for more Security Files and tech tips.
How the money moves
A government payment in Uganda starts at the Ministry of Finance, in the Integrated Financial Management System (IFMS). IFMS creates an electronic payment file saying who gets paid, how much, and to which account. That file is encrypted and sent to the Bank of Uganda, which pays it out through SWIFT. Each step trusts the step before it.
What prosecutors say happened
According to the charges, payment files were changed after they were created but before they were encrypted and sent to the central bank. Computer scripts were allegedly used to swap Uganda’s lenders for foreign companies. Forensic reports cited by prosecutors say administrator-level access was used.
On September 12 and 30, 2024, payments worth more than $14 million went to the wrong place, prosecutors say: over $6 million to a company in Tokyo and over $8 million to a company in London. Prosecutors also allege that reconciliation emails were intercepted and changed, email server logs were deleted, and false reports were prepared showing the lenders as paid. A further attempt to send more than $6.6 million to a company in Poland was blocked after the World Bank raised a missed repayment.
Early media reports said hackers had stolen about UGX 62 billion. The Bank of Uganda said international payments had been diverted, and its deputy governor later said there was no evidence that the central bank’s own systems had been hacked. Police ICT experts reportedly concluded it was an internal payment fraud. The Bank of Uganda recovered more than $8.2 million through UK banks; the money sent to Japan has not been recovered.
In February 2025, nine Ministry of Finance officials were arrested. In March 2026, they were committed to the High Court for trial on 19 charges. They have not been convicted. The case is still before the court, and they are presumed innocent unless proven guilty.
Protect your own payments: 5 things to do today
- Confirm bank-detail changes by phone, using a number you already have. Never act on an email alone.
- Split the power. The person who creates a payment should never be the only one who approves it.
- Limit admin access, and keep logs where no single person can delete them.
- Check the money arrived. Confirm with your bank and your suppliers.
- Act on red flags. When something doesn’t add up, stop and check before the next payment goes out.
Sources
- Pulse Uganda: officials committed to the High Court (March 2026)
- The Observer: the prosecution’s case
- JURIST: the charges (February 2025)
- Daily Monitor: the arrests
- Central Banking: the Bank of Uganda’s investigation
Figures come from public reporting and the prosecution’s case as reported, and different outlets give different amounts.