Siinqee Bank Data Breach
The ransomware group LockBit has listed Siinqee Bank, an Ethiopian bank, as a victim and published data it says belongs to the bank.
Stealer-log monitoring shows credentials tied to the bank's domain circulating around the same time.
TL;DR
- September 20, 2026: LockBit claimed Siinqee Bank as a victim.
- SOCRadar, a threat intelligence platform, identified 25 records tied to the bank's domain,
most harvested between September 12 and 21, 2026, with older entries going back to March 2025. - LockBit listed data it claims belongs to the bank on its leak site on October 5, 2026.
- The leak appears to contain sensitive information about internal systems, customers, cards, loans, and staff data. None of this has been independently confirmed by the bank.
An infostealer is malware that quietly collects data from a victim's device. It uses multiple techniques to access and extract data.
The output file created by an infostealer malware is called a "stealer log." These logs often include personally identifiable information (PII).
LockBit is a ransomware-as-a-service group active since 2019. It is financially motivated, and its affiliates have mostly targeted big industries in wealthy countries, making an Ethiopian bank an unusual victim.
Siinqee Bank is an Ethiopian bank that has grown from a microfinance institution around October 2021.
According to SOCRadar, a threat intelligence platform, there have been 25 records regarding the domain siinqeebank[.]com, some dating back to March 2025.
These records include:
- A corporate Google credential
- Credentials for internal infrastructure and development systems
- 18 of the 25 are from the recruitment portal subdomain
- External consumer accounts on bank-owned subdomains
Stealer logs show that these credentials were harvested from infected devices. They do not show that anyone used them to log in.
Timeline
- March 2025: earliest stealer-log entries.
- September 12-21, 2026: main harvest window.
- September 16, 2026: The bank sent customers a fraud alert. No public link to the breach.
- September 20, 2026: LockBit claimed the bank as a victim.
- October 5, 2026: Data listed on the leak site.
The leaked material appears to include customer identity details, card data, loan data, staff data, and internal documents.
The bank has not publicly confirmed these details, so these descriptions remain claims.
There are no official reports on how the data leak happened.
The mix of credentials from the internal, development, and recruitment portal is consistent with infostealer-harvested logins as an entry point, but whether they were used is unknown.
Given the sensitivity of the data leak, potential attackers might misuse it in several ways.
Having customer identity, card, loan, and staff data in one place could make convincing impersonation possible: identity theft, account takeover, SIM swap, phishing, and fake calls from "the bank."
Combined, the risk is higher than any single type of data.
If you're Siinqee Bank's customer, you should treat any call or SMS claiming to be the bank with suspicion, never share OTPs, monitor your accounts regularly, and report anything odd.
The bank's fraud alert is worth reading for more information.
Disclosure note
I notified Siinqee Bank on October 10, 2026, and gave them a week before publishing. They didn’t respond back to my email.
Disclaimer
Published for threat intelligence and awareness only. Data is gathered from public threat actor portals; no stolen data is hosted, bought, or redistributed here. Correction: Contact here