After 9th December 2018, the management of Unaitas Sacco (formerly Muramati) changed following media reports that the Sacco had been hacked and millions carted away by hackers.
The Management, furious by an article appearing in the Standard Newspaper, issued a statement clarifying the position. It is the management that gave the Sh25 million figure.
“It is in the public domain that a wave of cyber-attacks hit several financial institutions including Saccos. In the Case of Unaitas, we wish to state that the attack occurred in February 2017, where the Sacco lost Sh25million”, the press release in 2018 stated in part.
Unaitas went on to state that they have ‘put in measures to secure their systems’, the Sacco also boasted of having installed ‘a secure mobile banking platform and the latest version of a core banking system (T24) R17″.
A few years later, in April 2020, there were reports of a hacking which affected Saccos and Microfinance banks, where the Business to Customer (B2C) API were hit. Unaitas Sacco was one of the hit, sources intimated.
It is not know how much Unaitas Sacco lost to the hackers as the company, in a press release, the following day, vehemently denied they were hacked.
“Unaitas Sacco has noted with concern misinformation going round on social media that our systems have been breached, contrary to reports, our systems are intact, and very secure,” the statement read in part.
However, in an industry that is so lucrative for hackers, where hackers cart away billions every year. Unaitas Management were ‘telling it to the birds’.
A series of events would open the lid and expose the lie in that April 2020 statement.
27 year old Sacco
The Sacco which started in Muranga in 1993 has indeed grown to become the seventh largest in terms of asset base.
Talk of humble beginnings, the Sacco has since expanded to various locations in the country. The groowth trajectory was looking good and the management were flying high in the wind to even have the dream of converting it into a bank in their 2019 – 2023 strategic plans.
The plan was shelved in March 2020, citing a Central Bank of Kenya (CBK) moratorium order as well as the need to grow further.
The Sacco which seeks to raise its membership from 300,000 to 750,000 and raise asset base from current Sh13 billion to 32 billion in the next five years, cited a November 2015 CBK order to shelve its 2019 to 2023 strategic plan? Sounds fishy.
No doubt Unaitas growth is commendable and big but also in this growth, hackers cannot just have a field day thrice without inside help.
In the 2018 hacking, the Standard reported that, after detectives went through 682 gigabytes (GB) of data mined from the servers in Murang’a, they noted that the fraudulent activities had been made to appear as having been initiated by users who last genuinely updated their accounts, however a close scrutiny revealed that some of the users had long left the organisation.
“It is noted that the attacker manipulated the date and time spreading the attack period to six years, that is 2012 to 2017 purposely to misdirect investigations,” the report read in part.
The 2020 attack could have been avoided if the Sacco’s management learnt from the two attacks previously in 2017 and November 2018. Issuing statements that there as no attack, instead of there ws no money lost raises eyebrows.
It was reported that the attackers who were believed to be operating from outside the country, were able to navigate through flagged accounts, unflag and transfer funds, it adds. There were also a number of logs generated from mobile transaction and deleted successfully. The management were stunned, not knowing what to do.
Industry players believe that most of these attacks is what has put a roadblock between the Sacco and its dream to become a commercial bank.
Reports indicate that the Sacco has lost hundreds of Million in all these instances.
The management has refused to seal the internal insider fraud loopholes that have seen members keep losing billions.
