Operation Sentinel: what 574 arrests reveal about African cybercrime

More than a police headline

Operation Sentinel, coordinated by INTERPOL from 27 October to 27 November 2025, brought together 19 African countries against three threat families: business email compromise, digital extortion and ransomware. The public results are substantial: 574 arrests, USD 3 million recovered, more than 6,000 malicious links taken down and six ransomware variants decrypted.

Those figures should not be read as a one-off victory. They point to a structural shift. African cybercrime is no longer only a sequence of isolated cases. It runs through infrastructure: fraudulent domains, payment mules, hosting providers, messaging groups, scripts, wallets, bank accounts and laundering chains. The response therefore has to become infrastructural as well.

What the public record says

INTERPOL states that Operation Sentinel was conducted under the African Joint Operation against Cybercrime, funded by the United Kingdom and supported through the GLACY-e project of the European Union and Council of Europe. The operation focused on threats identified as growing in the 2025 Africa Cyberthreat Assessment: BEC, digital extortion and ransomware.

One cited case involved a Ghanaian financial institution hit by ransomware that encrypted 100 terabytes of data and stole about USD 120,000, disrupting critical services. INTERPOL also describes fraud and extortion networks operating across countries. The technical details of every arrest are not public, so it would be inaccurate to attribute all cases to one actor or one campaign.

Why it matters for African organisations

The value of Operation Sentinel is operational. A company hit by BEC or ransomware is often only one node in a cross-border chain. The email may come from a compromised domain, the payment may move through a local mule, infrastructure may be hosted elsewhere, victims may be dispersed and actors may change identities across platforms. A purely national investigation rarely sees the full chain.

Coordinated policing reduces that asymmetry. When law enforcement shares indicators, links, accounts, wallets and tactics, small incidents can be connected into a larger picture. For CISOs, banks, fintechs and telecom operators, reporting is therefore not merely a compliance exercise. It is intelligence that can help dismantle infrastructure used against many victims.

Ghana as a financial-sector warning

The Ghanaian case is especially instructive. A financial institution facing 100 TB of encrypted data is not dealing with a narrow IT outage. It must manage continuity, fraud exposure, customer trust, regulatory duties, restoration, possible negotiation and public communication. The reported USD 120,000 theft is only one part of the damage.

For African banks and fintechs, the main risk is systemic. One incident can affect payments, collections, agents, partner APIs and customer service. The African financial sector has invested heavily in transaction speed and user experience. It now needs the same discipline for restoration, segmentation, detection and evidence preservation.

What governments should take from it

INTERPOL operations show that continental capability is growing, but they also expose maturity gaps. Countries with cyber units, active CERTs, judicial contact points and fund-freezing procedures benefit more from coordinated action. Others risk becoming convenient transit zones for criminal infrastructure.

Governments should treat such operations as maturity tests. Can an indicator be received and acted on within hours? Can a mule account be identified, evidence preserved and funds frozen? Can data be requested quickly from a foreign platform or hosting provider? Can authorities communicate without compromising the investigation? These capabilities matter as much as buying security tools.

Victims are part of the collective response

One point is often underestimated: the quality of initial reporting. Many organisations hesitate to report fraud because they fear reputational damage, regulatory exposure or administrative burden. In an operation like Sentinel, however, a fraudulent domain, mule account, wallet address or extortion message can become the link between several investigations. Silence rarely protects the victim. More often, it protects the criminal infrastructure that will be reused against others.

From operation to doctrine

The strategic challenge is to avoid treating each INTERPOL operation as an exceptional mobilisation. African states need repeatable doctrine: who receives technical indicators, who validates urgent financial freezes, who talks to platforms, and how private-sector evidence is preserved. Without that doctrine, each new campaign restarts the learning curve. With it, regional operations become faster, cheaper and more credible.

Practical recommendations

• Organisations should report BEC, extortion and ransomware quickly, including domains, IPs, wallets, bank accounts and timestamped evidence.
• Banks and fintechs should maintain emergency freezing channels with cybercrime units and financial intelligence units.
• National CERTs should publish anonymised post-operation bulletins that convert arrests into defensive learning.
• Boards should track restoration time and reporting time, not only direct financial loss.
• States should include prosecutors, financial regulators and data protection authorities in cybercrime exercises.

Conclusion

Operation Sentinel confirms that African cybercrime is organised, cross-border and increasingly industrialised. The response cannot remain fragmented. Arrests matter, but the durable objective is larger: turn every reported incident into usable intelligence, every dismantled infrastructure into defensive lessons, and every regional operation into permanent capability.

— ◆ —