Cyber Incident Victim: Republic of Mali
Date:
Jun 2022
Location:
Mali
Summary
The Malian administration suffered a significant cyberattack attributed to the Russia-linked Lockbit group, compromising sensitive taxpayer data belonging to over 312,000 individuals. The incident coincided with heightened bilateral cooperation between Mali and Russia, though the attack was attributed to cybercriminals rather than state actors. Lockbit, identified as one of the world's most prolific cyber-extortion operations, typically avoids targeting systems within Russia and former Soviet states. Security experts indicate the breach aimed primarily at financial gain through the illicit sale of stolen personal information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In June 2022, Mali’s government administration experienced a significant cyberattack resulting in the compromise of sensitive taxpayer data. The breach, reported by Jeune Afrique, involved Russian-nationality hackers affiliated with the Lockbit cybercrime group exfiltrating records belonging to over 312,000 Malian taxpayers. The incident coincided with a period of strengthened diplomatic and cooperative ties between Mali and Russia, though the articles specify no direct involvement by the Russian state. Lockbit, identified as one of the world’s most prolific cyber-extortion franchises, executed the attack to steal and potentially monetize the data. Security analysts noted Lockbit’s operational pattern of avoiding targets within Russian territory while freely conducting attacks across former Soviet states. The breach exposed extensive personal and financial information, though specific details regarding the compromised systems or intrusion methods were not disclosed in available sources.
The attack raised geopolitical concerns due to the perpetrators’ nationality and Mali’s deepening relations with Moscow. Qémal Affagnon, West Africa lead for Internet Sans Frontières, emphasized the financially motivated nature of such operations, with stolen data likely intended for sale or extortion. No official statements from Malian authorities regarding incident response, containment measures, or recovery efforts were cited in the reporting. The scale of the breach—impacting hundreds of thousands of citizens—highlighted vulnerabilities within Mali’s administrative infrastructure. Lockbit’s involvement underscored the group’s continued global activity, exploiting jurisdictional limitations and cross-border coordination challenges in cybersecurity enforcement. The incident demonstrated tangible risks to national data systems amid expanding digital governance frameworks in the region.