Central Bank of Libya Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Central Bank of Libya appeared on a listing associated with the qilin ransomware group on June 22, 2026. Public information about the incident remains limited: the number of people affected is unknown, and the precise contents of any material have not been disclosed beyond a reference to internal files.

Such an event at a central bank raises questions about the handling of sensitive financial and operational records that underpin a national payments system. Individuals and institutions that interact with the bank have an interest in understanding what, if anything, may have been exposed.

Inside the incident

Available details are confined to the listing itself. The group claims to have exfiltrated internal files during a ransomware operation. No confirmation of the claim, no statement on the volume of data, and no timeline of the intrusion have been made public. The number of individuals whose information may be involved is reported as unknown.

The group behind it: qilin

Qilin is a ransomware operation that has conducted multiple intrusions since at least 2022. Public reporting describes the group’s practice of encrypting systems and copying data, then posting victim names on a leak site to pressure organisations into negotiations. The group’s listings are presented by the actors themselves and are not independently verified at the time they appear.

Like other ransomware groups, qilin has targeted organisations in various sectors. Its listings do not always result in the public release of files; some remain unconfirmed or are later removed without further disclosure.

Central Bank of Libya and its sector

The Central Bank of Libya is the country’s monetary authority, responsible for issuing currency, supervising banks, and managing foreign reserves. Central banks routinely process large volumes of transaction data, maintain records on licensed financial institutions, and hold information on payment systems and regulatory matters.

A successful intrusion at such an institution can affect operational continuity and the confidentiality of records that extend beyond the bank itself to the wider financial sector it oversees.

The information in question

The only detail released about the material is a reference to internal files exfiltrated in a ransomware attack. No inventory of specific data types, file counts, or time periods has been published. Organisations of this kind typically hold records relating to banking supervision, payment instructions, and internal correspondence, yet the exact contents in this case remain unconfirmed.

What's at stake

Where internal files are involved, the main concerns are potential misuse of operational information and any personal or institutional data that may be contained within those files. Central-bank records can include details that affect financial stability, regulatory actions, or individual account relationships, though the presence of such data in the exfiltrated material has not been established.

For the organisation, the incident adds to the workload of verifying the scope of access, notifying relevant authorities, and restoring systems without introducing further risk.

What to do if you're exposed

Anyone who holds accounts or relationships with Libyan financial institutions can monitor official statements from the Central Bank of Libya for further information. Basic protective steps include reviewing recent account activity, enabling multi-factor authentication on any linked services, and treating unexpected communications with extra caution.

Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.