Senegal’s public treasury hit by cyber threat amid digital push

The recent cyberattack targeting the Senegalese public treasury underscores a growing concern in Dakar. Over just six months, three central government agencies have faced breaches, thrusting the issue of cybersecurity into the spotlight of Senegal’s digital sovereignty debate. This incident coincides with the state’s accelerated push to digitize its services, inadvertently widening the attack surface for malicious actors. The frequency of these intrusions raises serious questions about the robustness of the safeguards protecting critical national infrastructure.

The latest breach at the Directorate-General of the Treasury and Public Accounting follows two prior high-profile incidents. In October, the tax portal operated by the Directorate-General of Taxes and Estates was compromised. Earlier, in January, the agency responsible for producing national identity cards fell victim to a similar attack, disrupting a system that directly impacts everyday citizens. These successive intrusions paint a troubling picture: taxes, civil records, and public finances—cornerstones of the administrative machinery—are now prime targets.

Rapid digitization outpaces security readiness

Like many African nations modernizing their public administrations, Senegal has rolled out numerous digital initiatives without consistently pairing them with equally robust security frameworks. While the push toward e-government promises greater efficiency and transparency, it demands parallel investments in data protection, continuous monitoring, and staff training. The gap between digitization speed and security reinforcement is precisely the vulnerability cybercriminals exploit. Attackers typically pursue three objectives: extortion through ransomware, theft of sensitive data for resale, or symbolic destabilization of state institutions. In the case of the Treasury, which manages the state’s financial flows, the stakes are even higher. A prolonged breach could disrupt public expenditure chains, municipal account tracking, or even domestic debt management. Authorities have yet to disclose the exact nature of the intrusion or the scale of any data exfiltration.

Africa’s growing appeal for cybercriminals

Senegal is far from alone in facing this threat. Over the past two years, several African countries engaged in ambitious e-government programs have suffered large-scale cyber offensives. The surge in internet connectivity, the rise of mobile payments, and the gradual shift of public records to cloud platforms have created an especially fertile environment for cybercriminals—whether operating from within Africa or abroad. The cost-benefit ratio of these attacks remains heavily skewed in favor of attackers: potential ransoms are substantial, while the likelihood of cross-border prosecutions remains slim.

Dakar boasts an institutional framework, including the Personal Data Protection Commission (CDP) and initiatives led by the State IT Agency (ADIE). Yet operational coordination between agencies, incident response capabilities, and cybersecurity awareness among public servants remain unfinished priorities. The escalation in attacks may push authorities to adopt a stricter national strategy, featuring regular audits, simulated attack drills, and stronger mandatory breach notifications.

What political response is expected

For the government, the stakes are now political as well. Public trust in digitized services hinges on the assurance that tax, biometric, and financial data are secure. Three breaches in six months erode this trust and weaken the case for expanding major digital projects. Pressure is also mounting on technical vendors contracted by the state, where cost often trumps the robustness of security solutions. Beyond Senegal, these cascading attacks highlight a broader truth: African digital sovereignty isn’t just about local data hosting or national apps. It requires real capabilities to detect, contain, and neutralize increasingly sophisticated intrusions.