- Libya’s Central Bank (CBL) says it’s investigating claims that data from a recent cyberattack just went live on the dark web.
- The bank neither confirmed nor denied the authenticity of the allegedly leaked information.
- Officials say banking services, customer accounts, and the country’s financial system remain fully operational and secure.
CBL just acknowledged reports that data allegedly stolen during a cyberattack three weeks ago hit the dark web. Investigations to verify this claim are in progress.
In a statement issued this week, the bank said its technical teams are continuing to analyze the allegedly leaked material. They are working with international cybersecurity companies and external experts to determine whether the data is from the earlier attack.
The announcement follows reports of claims that threat actors had brandished a sample of data purportedly taken during the breach.
No Negotiations with Threat Actors
CBL made clear that it won’t negotiate with cybercriminals or support ransom demands that violate Libya’s legal and regulatory framework. Officials also reaffirmed the common stance among governments and financial institutions worldwide: refusing to finance cybercriminal operations through ransom payments.
Data extortion attacks have now become the fastest-growing form of cybercrime over the past several years. Rather than encrypting systems with ransomware, threat groups steal sensitive information before threatening to publish it unless victims pay ransom.
In many recent incidents, organizations have faced difficult decisions after attackers leaked portions of stolen data to increase pressure during negotiations.
The Icarus ransomware group, for example, has used this exact tactic, listing companies like Klue on their leak site to pressure victims into negotiations. The Central Bank’s statement indicates Libya intends to resist such tactics.
Operations to Remain Functional as Investigation Continues
According to CBL, the published material, if confirmed, would relate to the same cyberattack that hit them three weeks ago. The institution said it activated emergency response procedures immediately after discovering the intrusion.
This allowed technical teams to contain the incident and begin forensic investigations. Officials stated that cybersecurity specialists continue to examine both the nature and volume of the allegedly leaked information.
Amid these background works, banking services, customer accounts, and the bank’s financial system remain fully operational. They are working alongside international cybersecurity firms and experts to conduct technical analysis to determine precisely what information got out.
Broader Cybersecurity Challenges
Central banks are now the focus point for sophisticated cybercriminal groups. Attacks against commercial banks often focus on customer funds or payment systems. However, breaches involving central banks may seek intelligence, regulatory information, financial documents, or strategic government data.
According to cybersecurity experts, unaffected operational systems can create reputational risks and expose institutions to further attacks. This hints at one of the possible reasons behind the attack.
The Central Bank said technical and criminal investigations remain active and under operation in coordination with both Libyan authorities and international security partners. Officials added that efforts are underway to strengthen the institution’s digital infrastructure, improve operational readiness, and enhance cybersecurity defenses against future attacks.
At present, there’s no verification to the authenticity of the allegedly leaked data. Until forensic results roll out, the Central Bank has urged caution regarding claims circulating on underground forums.
