CENTRAL BANK OF GAMBIA HACKED 2 TB OF CRITICAL DATA WAS STOLEN Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In early November 2022, the Central Bank of The Gambia appeared on the leak site of the alphv ransomware group, which claimed to have stolen roughly 2 TB of critical internal data from the institution. Public reporting of the listing is dated 8 November 2022. The number of people affected remains unknown, and independent confirmation of the intrusion or the precise contents of any stolen material has not been made public.

Because the organisation is the country’s central bank, any verified compromise of its systems would carry implications for financial stability, regulatory functions and the personal and commercial data it holds. At present the incident rests on the group’s unverified claims.

Inside the incident

According to the alphv listing, the group asserted that it had exfiltrated internal files in a ransomware attack and that approximately 2 TB of data had been taken. The posting included a Tor link said to contain a sample of the material and stated that the remainder was being offered for sale by auction, with bidding scheduled to end on 7 December. An email address was supplied for prospective buyers. The listing also reproduced basic public information about the bank, including its location in Banjul and its establishment in 1971.

No technical details of the initial access method, the duration of any intrusion, or the specific systems affected have been disclosed in the available record. The number of individuals whose information may have been involved is listed as unknown. Whether a ransom was demanded, paid or refused is likewise unconfirmed. The only concrete assertions about volume and content originate from the threat actor’s own statement.

Inside alphv

Alphv, also widely known as BlackCat, is a ransomware operation that emerged in late 2021 and functioned as a ransomware-as-a-service platform. Affiliates conducted intrusions, deployed the group’s encryptor, and shared proceeds with the core developers. The group was notable for using a Rust-based payload, offering customisable encryption and leak-site options, and for targeting large organisations across multiple sectors. Like other ransomware crews of the period, alphv routinely claimed data theft in addition to encryption and published victim names on a Tor-based leak site to increase pressure.

Public reporting has linked alphv to numerous high-profile incidents before and after 2022; the group’s listings were claims that required independent verification. In this case the appearance of the Central Bank of The Gambia on the site constitutes an unverified assertion by the actors. No additional statements from alphv specific to this victim beyond the November 2022 listing text are recorded in the facts provided.

About Central Bank of The Gambia

The Central Bank of The Gambia, often abbreviated CBG, is the country’s monetary authority. It was established in 1971 and is headquartered in Banjul. Like other central banks, its core responsibilities include issuing the national currency, formulating and implementing monetary policy, supervising commercial banks and other financial institutions, managing foreign reserves, and acting as banker to the government.

Institutions of this type routinely hold sensitive supervisory files, payment-system data, internal policy documents, staff records and correspondence with commercial banks and international counterparts. A breach affecting such an organisation is consequential because it can expose both the operational workings of the financial system and the personal or commercial information of individuals and entities that interact with the bank.

What was likely exposed

The available facts state only that internal files were exfiltrated in a ransomware attack. The alphv listing described the material as “critical data” and “financial and personal data,” yet no inventory of file types, databases or record counts has been independently confirmed. Exact contents therefore remain unconfirmed.

Central banks typically maintain monetary-policy papers, bank-supervision reports, payment and settlement records, employee and contractor information, and correspondence containing personal identifiers or commercially sensitive details. Whether any of those categories were present in the claimed 2 TB set cannot be verified from the public record. Readers should treat specific claims about the nature of the data as unproven until corroborated by the institution or by forensic reporting.

What's at stake

If internal files were indeed taken, the practical risks include potential misuse of personal identifiers for fraud or social engineering, exposure of confidential supervisory assessments that could affect market confidence, and the possible leakage of operational details that adversaries might later exploit. For individuals whose data may have been held by the bank—staff, contractors, or persons named in regulatory files—the chief concerns are identity theft, targeted phishing and unsolicited contact from criminals posing as officials.

For the institution itself, the stakes involve reputational damage, the cost of investigation and remediation, and any regulatory or diplomatic consequences that follow a claimed compromise of a national monetary authority. Because the scale of affected individuals is unknown and the precise data types unconfirmed, the full extent of harm cannot yet be quantified.

What to do if you're exposed

Anyone who believes their information may have been held by the Central Bank of The Gambia should monitor financial accounts and credit reports for unusual activity, enable multi-factor authentication on email and banking services, and treat unsolicited requests for personal or financial details with caution. Official communications from the bank or from Gambian authorities should be verified through known channels rather than links or addresses supplied in unsolicited messages.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Remaining alert to phishing and keeping software updated remain practical steps while further official details, if any, are released.

AICompiled with AI assistance from public sources and published under our editorial standards.