From Uganda's electricity transmission network to telecommunications and financial systems, INTERPOL says Africa is facing an increasingly sophisticated cybercrime threat as criminals turn their attention to critical infrastructure, reports Ronald Musoke.
On August 18, 2025, the Qilin ransomware group claimed Uganda Electricity Transmission Company Limited (UETCL) as a victim. The group, which operates a ransomware-as-a-service model, listed the Ugandan electricity transmission company on its leak site and said it had breached its systems.
The claim was recorded the following day, August 19, 2025, by cyber-threat intelligence platforms tracking ransomware activity around the world. The material Qilin said it had obtained included "internal contracts, identity documents, financial statements and service agreements."
The target was significant. UETCL is Uganda's state-owned electricity transmission utility, responsible for moving bulk electricity across the country and beyond national borders through its high-voltage transmission network. A successful cyber intrusion against such an agency is therefore not simply a corporate data breach. It raises questions about the security of infrastructure on which millions of homes, businesses, hospitals and other essential services depend.
Keep up with the latest headlines on WhatsApp | LinkedIn
Qilin's claim came with the familiar threat of ransomware gangs: publish the stolen information if the victim does not comply. But the story did not end with the group's dark-web posting. The INTERPOL African Cyberthreat Assessment Report 2026 published on Aug. 3, 2026, now places the August 2025 UETCL incident within a much wider African cyber threat.
INTERPOL or the International Criminal Police Organization, which is based in Lyon, France, describes what happened at UETCL as a suspected ransomware incident in which monitoring systems for Uganda's national power grid were compromised. Electricity service was restored through backup protocols.
The significance of the episode is therefore larger than the fortunes of one ransomware group. It is a warning about what happens when Africa's rapid digital transformation collides with increasingly sophisticated cybercrime.
A power grid is now a digital target
Electricity infrastructure has always been vulnerable to physical threats. Transmission towers can be vandalized. Substations can be damaged. Equipment can fail. But modern electricity systems have another layer of vulnerability: the digital systems used to monitor, communicate and manage them.
Power grids increasingly rely on sensors, automated controls, communications networks, real-time data and connected devices. The technology improves efficiency and allows operators to monitor complex networks in real time. It also expands the number of systems that must be protected. That makes electricity utilities attractive targets for ransomware operators and other cybercriminals. The danger is not that every ransomware attack against a power company will automatically cause a blackout. It is that an intrusion can target the digital infrastructure supporting the physical infrastructure.
The global energy sector has already seen the consequences. European electricity industry data has recorded a sharp increase in cyberattacks against energy infrastructure, while documented incidents in different parts of the world have shown how ransomware, phishing, denial-of-service attacks and compromised suppliers can be used against energy companies.
The underlying vulnerability is straightforward: the more connected an electricity network becomes, the more important cybersecurity becomes to the reliability of the physical network. That is why the UETCL incident matters. It shows how an organisation responsible for a country's electricity infrastructure can become a target in a criminal economy that operates across borders and does not require attackers to be physically present in Uganda. And UETCL is not alone.
UETCL's public threat conversation
Yet, there is an interesting contrast in how UETCL has publicly discussed threats to its critical infrastructure. On May 1, 2026, UETCL Chief Executive Officer, Eng. Richard Matsiko, spoke to local broadcaster, NTV, about the security of the company's transmission network.
His focus was overwhelmingly physical. Matsiko discussed vandalism, cooperation with the police and the Criminal Investigations Directorate, community sensitisation, security patrols and efforts to make transmission structures harder to attack. He said UETCL had identified areas where vandalism was more prevalent and was working with security agencies and local communities to protect infrastructure.
He also spoke about using technology to improve the quick detection of incidents. What was striking was what did not feature in the interview. Matsiko did not discuss ransomware, cyberattacks or the Qilin claim against UETCL.
That does not show that UETCL lacks cybersecurity systems or that the company was unaware of the threat. But it provides a useful snapshot of the public security conversation around Uganda's electricity infrastructure in May 2026: physical vandalism was front and centre.
INTERPOL's assessment shows why that conversation now needs to encompass the digital side of the grid as well. The threat is no longer confined to someone physically cutting a transmission structure. A criminal group can sit thousands of kilometres away and attempt to penetrate the systems-monitoring infrastructure from a laptop.
East Africa's cybercrime problem
The UETCL incident has become more significant when placed against INTERPOL's assessment of East Africa. The organisation identifies East Africa as a hub for mobile-money fraud and infrastructure-targeted ransomware.
Kenya offers a glimpse of the scale. INTERPOL says Kenya recorded more than 46,000 distributed denial-of-service attacks against telecommunications infrastructure during the first half of 2025. The country's communications regulator also reported hundreds of millions of intrusion attempts against government and ICT infrastructure between July and September 2025.
The same digital ecosystem is being exploited for financial crime. INTERPOL says 97% of countries responding to its survey identified mobile-money fraud as a significant problem. Kenya detected more than 123,000 fraudulent SIM cards in 2025, while Tanzania and Rwanda reported similar mobile-money and identity-related vulnerabilities.
This is important because it shows that East Africa's cyber threat is not one-dimensional. The criminals are going after money. They are going after identities. They are going after telecommunications, and increasingly, they are going after infrastructure.
The same digital expansion that allows a consumer to send money instantly, a business to operate across borders or a utility to monitor its network remotely can create another opportunity for criminals to penetrate systems.
Ransomware has become a weapon of disruption
INTERPOL says ransomware itself is changing. The traditional image is of criminals locking an organisation's files and demanding payment for their release. But the 2026 assessment says ransomware is increasingly being used for systemic disruption, with attackers targeting public services and critical infrastructure because disruption gives them greater leverage.
That makes the energy sector particularly attractive. An organisation can survive the theft of some documents. A utility responsible for essential services faces a different level of pressure when its operational systems are affected. INTERPOL Director of Cybercrime, Neal Jetton, puts the broader threat bluntly: "The scale and sophistication of cyberattacks across Africa are accelerating, especially against critical sectors like finance and energy."
The warning is significant because energy is not being treated as just another industry. It is part of the critical infrastructure on which national economies depend. That is precisely what gives a reported attack on UETCL its wider significance. The Qilin claim is one event. The structural vulnerability is much bigger.
Africa's digital success is creating a bigger target
INTERPOL's report, drawing on intelligence from law-enforcement agencies in 36 African countries and information from private-sector partners, describes cybercrime as an increasingly industrialized and borderless ecosystem. Africa's digital economy helps explain why.
The continent had more than 1.1 billion mobile subscriptions and more than US$ 1.1 trillion in digital transactions in 2025, according to the assessment. About 570 million people were using the internet. Those figures represent a transformation in how Africans work, communicate, shop, move money and interact with government. They also represent a huge criminal opportunity.
INTERPOL says reported cybercrime-related losses more than doubled from US$192 million in 2024 to US$ 484 million in 2025. The organisation estimates that cybercrime caused at least US$5 billion in direct economic damage across Africa during 2025.
Financial services, telecommunications and government institutions feature among the sectors most affected. But there is another number that may be even more revealing. Close to 90% of surveyed countries identified pervasive underreporting as a major problem. INTERPOL attributes that to factors including weak reporting mechanisms, reputational concerns, inadequate forensic capabilities and uncertainty about legal obligations.
That means the visible cybercrime statistics are only part of the story. Attacks can happen without becoming public. Victims can choose silence. Organisations can lack the technical capacity to determine exactly what happened. And governments may not have all the information needed to connect attacks occurring in different jurisdictions. For critical infrastructure, that is a particularly dangerous gap.
AI is accelerating the threat
Meanwhile, INTERPOL's assessment says 55% of cybercrime cases in 2025 involved artificial intelligence, with criminals using the technology across the attack chain, including reconnaissance, phishing, extortion and evasion.
The significance is not simply that criminals have access to another tool. AI allows criminals to automate and scale activities that previously required more time and expertise. Phishing messages can become more convincing. Identities can be fabricated, and impersonation can become harder to detect, while malicious campaigns can be adapted more quickly.
Jetton says AI is already reshaping the criminal process: "AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion." INTERPOL says deepfake incidents increased sevenfold between the second and fourth quarters of 2024, as criminals increasingly used synthetic audio and video to impersonate officials, executives and other trusted individuals.
Uganda features in this part of the assessment too. INTERPOL cites a deepfake investment scam involving a prominent Ugandan public figure that reportedly resulted in losses of more than US$2 million. The example shows that Uganda's exposure to cybercrime extends far beyond the electricity sector. The same country can face threats to critical infrastructure, financial systems, identities and public trust.
The criminals move faster than the institutions
According to the report, Africa's cyber problem is not simply a shortage of technology. It is also a shortage of capacity. INTERPOL says many law-enforcement agencies lack enough trained personnel, modern digital-forensics tools and interoperable systems.
The report notes that 92% of agencies surveyed identified a lack of technical expertise as the primary barrier to adopting AI tools, while only 8% of intelligence analysts had advanced AI expertise. That creates a widening gap.
Criminals can operate across jurisdictions, use digital infrastructure in multiple countries and automate parts of their operations. Investigators must work through national laws, different evidence requirements and sometimes slow channels for obtaining information from another country.
INTERPOL says differences in legislation, data-protection rules and information-sharing mechanisms continue to hamper cross-border investigations. There is a similar problem between governments and private companies.
Telecommunications firms, banks, fintech companies, technology providers and cybersecurity companies can hold crucial information about attacks and criminals. Yet INTERPOL says public-private information sharing remains underdeveloped in many African countries, leaving valuable evidence fragmented across organisations. That fragmentation is an advantage for criminals. A ransomware operator needs only one successful route into a victim's network. Defenders need to protect the entire system.
Sign up for free AllAfrica Newsletters
Get the latest in African news delivered straight to your inbox
Africa is fighting back
The picture, however, is not one of helplessness. African governments and law-enforcement agencies are increasing cooperation, and INTERPOL has used multinational operations to target cybercrime networks operating across borders.
The report points to "Operation Sentinel", which involved 19 African countries and resulted in 574 arrests, the recovery of about US$ 3 million, the removal of more than 6,000 malicious links and the decryption of six ransomware variants. Uganda was among the participating countries.
The organisation's recommendations include stronger digital-forensics capabilities, faster cross-border cooperation, improved AI training for investigators and formal information-sharing arrangements between governments and private-sector organisations. For critical infrastructure, INTERPOL calls for sector-wide cyber audits and mandatory backup and recovery standards for public institutions.
The recommendation is particularly relevant to UETCL. INTERPOL says the company's electricity service was restored through backup protocols after the August 2025 incident. That recovery matters. But a backup is the last line of resilience, not the whole defence.
Utilities also need to know which systems are exposed, detect intrusions quickly, separate critical systems where possible, protect backups and share information about attacks so that one breach does not become a blueprint for the next.
The warning from UETCL
The physical threats to infrastructure remain. In Kampala, UETCL says vandalism costs it hundreds of millions of shillings each year, and Matsiko has described the damage to infrastructure and the wider economic consequences when electricity transmission is interrupted.
But the threat now has a digital dimension. A transmission company does not have to be physically breached for its infrastructure to come under attack. That is the larger lesson from the UETCL episode and the INTERPOL assessment.
Africa is digitizing faster than ever, mobile money is expanding, government services are moving online, telecommunications networks are becoming more central to economic life, and electricity infrastructure is increasingly dependent on digital monitoring and control. At the same time, cybercriminals are becoming more organised, more automated and more willing to target systems whose disruption can have consequences far beyond the original victim.
Jetton's warning is therefore not simply about cybercrime. It is about resilience. "No country can address these threats in isolation, and no single institution can match the agility of increasingly sophisticated criminal networks."
The reported Qilin targeting of UETCL is one episode in that larger contest. It shows why protecting Africa's critical infrastructure, including electricity grids can no longer mean protecting only towers, substations and transmission lines. The grid now extends into cyberspace. And the criminals know it.
