Development Bank of Seychelles Ransomware: 2026 Update

Development Bank of Seychelles ransomware in 2026: the short answer

The Development Bank of Seychelles (DBS) was hit by ransomware in September 2020, not August as our first report said. The bank told the Central Bank of Seychelles on September 9, and the regulator went public on September 11.[6][7] We found no public source that names the ransomware family, states a ransom demand or says whether anything was paid.

What we can confirm is the recovery. In an update reported on October 7, 2020, the bank said it was still restoring its core banking system and expected it to be running within three weeks.[8] We found no later public report that closes the case, and no arrest linked to this attack.

Timeline: from the first alert to the 2025 bank breach

What changed since 2020

The first reports left three open points: the attacker, the demand and the damage. Six years on, the public record has barely moved on the first two. Bitdefender noted in September 2020 that neither the strain nor the demands had been disclosed, and the bank had not explained how the attackers got in.[7] We found nothing later that fills those gaps.

The bank's own account of the damage also shifted in detail. Early on it said the affected server was disconnected and that no data was lost or compromised.[8] Weeks later it said restoring the core banking system would take about three more weeks.[8] Our reading is that the visible disruption lasted far longer than the first message suggested.

The wider picture has changed more. Since late 2019 many ransomware gangs steal files before encrypting them and threaten to publish them, a tactic BleepingComputer counted in 18 other gangs by September 2020.[6] That is why a bank incident like this is now treated as a possible data breach as well as an outage. In July 2025 the island's Seychelles Commercial Bank confirmed a customer data breach, and researchers at Resecurity noted that it was unclear whether the two cases were connected.[9]

Risks around the story (our analysis)

• Fake bank messages. After any bank incident, criminals send texts and emails that claim to fix your account. Do not follow links; use the number on your card.
• Leaked customer data. If a bank cannot say whether data was stolen, assume names, phone numbers and emails may circulate, as in the 2025 case.[9]
• Extortion of customers. In the 2025 breach the attacker emailed customers directly to pressure the bank.[9] Treat such emails as pressure, not proof.
• False claims about the attacker. No source we read ties this attack to a named gang. Be careful with posts that do.

Six steps for bank customers and small institutions

1. Use official channels. Take updates from the bank's website or the regulator, such as the Central Bank notice in this case.[6]

2. Watch your statements. Check your account weekly for small charges you do not recognise and report them at once.

3. Change passwords. Use a unique password and turn on two-factor sign-in for online banking. You can test your email with our leak check.

4. Expect phishing. Messages that mention the incident are likely bait. Our guide on reporting phishing explains where to send them.

5. Keep offline backups. A small institution that restores from a clean backup does not face the weeks of downtime that DBS described.[8] Test the restore before you need it.

6. Patch exposed systems. Update VPN, web and server software. The 2025 attacker claimed a server flaw as the way in, which shows why patching matters.[9]

What is still unknown

• Which ransomware family was used. We found no source that names it.
• Whether a ransom was demanded or paid.
• Whether customer or bank data was stolen, since the bank's early statement said none was lost.[8]
• The date the core banking system was fully restored.
• Whether the 2020 and 2025 Seychelles bank incidents are linked. Resecurity says this is unclear.[9]

Our original 2020 report

The text below is our report as first published in 2020. We keep it unchanged for the record; the sections above bring it up to date.

The beginning of September 2020 (our first version wrongly said August) was not the best time for the Seychelles banking sector. The Republic of Seychelles has been known for its beautiful nature and attracted tourists for many years. A country of small population, consisting of 115 islands in the Indian Ocean near Africa was a great escape for Western World families. Unfortunately, they have recently attracted not only tourists. The country with the smallest population in Africa has appeared on the radar of cybercriminals. [1]

On the 11th of September (not August, as we first wrote), The Central Bank of Seychelles has made a press release stating one of the country's banks has been hit by ransomware:

The incident was communicated to CBS on Wednesday 9 September 2020. Since then, CBS has
been engaging with DBS to establish the exact nature and circumstances of the incident and closely
monitor the developments, including the possible impact on DBS' operations.[2]

The Central Bank of Seychelles is making the official statements and helping to monitor the situation

It is not yet clear what are demands of the ransomware attackers, neither the ransom amount has been revealed. However, we can assume the numbers might be impressive as the recent banking attacks were not showing modesty. The Central Bank has promised to keep good communication with the public and hopefully might get back with more information in the nearest future.

The CBS has stressed on the need for DBS to maintain communication with its clients and other
stakeholders, particularly within the banking sector, throughout this process.

Earlier this year a well-known ransomware group called Maze[3] has hit the Banco BCR, the state-owned Bank of Costa Rica. The ransomware requested amount of money has not been officially confirmed, neither is clarified if the bank has made any payments, but the damage for Bank's safety and authority might have been huge. The ransomware gang has begun to reveal the bank's credit card information.

The Cyble Research team reported on May 1st, 2020 that the Bank of Costa Rica (BCR) has been attacked by Maze and harvested over 11 million credit cards – 4 million unique entries, 140,000 of which belong to American netizens.[4]

The demands of the ransomware and the Seychelles Bank's position not yet disclosed

Thought the official statements from the Central Bank of Seychelles (CBS) have been released, not much more information is known on the Development Bank of Seychelles ransomware attack. The ransomware actors have not made official statements too, so it is not yet clear which ransomware is responsible, neither their demands. The experts still have hopes for smaller damage to be made, while the CBS is trying to figure out the seriousness of the situation.

The CBS will be providing further details to the general public once the full extent of this reality
has been clearly understood.

The Development Bank of Seychelles has been operating for more than 40 years and has gained the trust of many clients during the time. The officially declared profit of 2017 was almost 16 million Seychellois rupee [5], which is almost 9mln US Dollars in today's currency exchange rates. Most likely the profits have increased since then and appeared to be a nice catch for the ransomware actors.

Related guides on 2-Spyware

• Check whether your email appeared in a leak
• Recent data breaches
• Ransomware removal guides
• How to report phishing