Lesotho 2023: the cyberattack that halted interbank payments

When an institution's incident becomes a national incident

On 11 December 2023, the Central Bank of Lesotho (CBL) experienced a cybersecurity incident on its systems. In a statement signed on 12 December, the Bank said it had investigated the matter and was working to restore its systems. It assured the public that it had suffered no financial or other loss, while explaining that certain systems had been suspended to prevent further infiltration by attackers.

That containment decision had an immediate user consequence: the central bank warned that some payments might be delayed while systems returned to normal. On 13 December, a joint statement from the CBL and the Bankers Association of Lesotho specified the scale of the disruption. Downtime of the National Payments System had made it impossible for all local banks to honour interbank transactions in the country.

The sequence established by official statements

The three December releases establish a careful timeline. On 11 December the incident occurred. On 12 December the Bank confirmed it, stated that it had suspended certain systems and warned of potential payment delays. On 13 December the central bank and banking association said interbank transactions could not be honoured through the unavailable national system and that business continuity processes and measures were being introduced.

On 15 December, a further joint release announced that the banking industry was again able to process interbank transfers after invoking its business continuity process while a permanent solution was sought. Customers were warned to expect some delays because payment processing was being carried out manually.

These official sources establish operational impact and continuity action. The cited statements do not release a comprehensive technical report identifying the initial vector, confirming a specific ransomware family or attributing the incident to a named criminal group. Any such additional claims require separately identified supporting evidence and should not be substituted for the bank's public record.

Why a payment system is critical infrastructure

A central bank does more than conduct monetary policy. It operates or oversees mechanisms allowing banks to settle obligations among themselves. When a customer pays a supplier at another bank, an employer disburses payroll or an institution transfers funds, the availability of interbank rails determines whether the economy can complete ordinary activity.

In a smaller economy, this concentration can make an incident especially visible. An outage does not merely affect one internal application: it can reach commercial banks, businesses, households and public institutions simultaneously. Lesotho's experience also shows that a justified security action, disconnecting systems to prevent spread, can itself create availability cost. Good containment must therefore be paired with a continuity mode that is ready to operate immediately.

The essential but limited role of manual processing

The restoration of transfers through a manual process supplied an important fall-back capability. Yet manual settlement carries limits: queues, additional checks, slower reconciliation, error risk and reduced customer visibility. It is a method for recovering an essential function, not a long-term substitute for the expected service level of a modern national payment system.

This is why central banks and participant banks need recurrent continuity exercises. Teams should know which payments receive priority, how an instruction is authenticated outside the primary system, how duplicate execution will be prevented after recovery, and how to inform the public without encouraging panic or creating opportunities for follow-on fraud.

Lessons for African financial systems

African markets are expanding instant payments, mobile wallets, interoperability and digital government disbursements. These developments extend financial inclusion and efficiency, but they also increase reliance on settlement infrastructure and its connections. The protection of a central platform cannot be treated only as an internal concern for each participant bank.

Central banks should handle cyber scenarios as operational stability scenarios: network isolation, recovery in a trusted environment, controlled manual transfer, interbank communication and synchronised return to production. Regulators should also require participant institutions to maintain customer-facing continuity and clear explanations of payment delays when a central rail is unavailable.

Practical priorities

• Exercise a cyber outage of the national payment system at least annually with participant banks and essential operators.
• Maintain emergency settlement mechanisms with fraud controls, value thresholds, logs and reconciliation procedures for recovery.
• Segment critical environments and prepare isolated restoration so containment does not become a prolonged interruption.
• During incidents, publish separate information on fund safety, payment availability and expected service delays.
• Include fintech, mobile money and government payment services in continuity planning where settlement relies on the same ecosystem.

Conclusion

Lesotho's December 2023 incident clearly demonstrated national dependency on digital payment infrastructure. The central bank publicly stated that it had suffered no financial loss, yet interbank payments were unavailable until continuity processing resumed. The African policy lesson is direct: cyber resilience of a central payment system is measured first by whether money can continue to move through the real economy.

— ◆ —