Seychelles’ Cybersecurity Wake-Up Call: Balancing Progress and Protection

By IndraStra Global Engineering Team

Picture a small island nation, home to just 121,355 people, scattered across 115 sun-soaked islands in the Indian Ocean. Seychelles is a place where turquoise waves meet ambitious dreams of digital progress. It’s a country leaning hard into technology to power its government, economy, and daily life—everything from banking to healthcare depends on it. But with that progress comes a shadow: cyber threats that don’t care about borders or the size of a nation. A recent data breach at Seychelles Commercial Bank (SCB) paints a vivid picture of a country at a crossroads, trying to protect its digital future while racing to keep up with sophisticated cyber risks. 
On July 11, 2025, SCB dropped a bombshell: a hacker had infiltrated its systems, snatching personal details of internet banking customers—names, email addresses, phone numbers, account types, and even balances. Some accounts, ominously labeled “current accounts – government,” were part of the haul, with balances reportedly reaching into the millions. The bank was quick to assure customers that “no funds have been accessed,” but the damage was done. Internet banking was shut down temporarily, with SCB stating it had “recently identified and contained a cybersecurity incident, which has resulted in its internet banking services being temporarily suspended.” Customers were told to hit up ATMs or visit branches, a frustrating detour for anyone used to banking from their phone.
The hacker didn’t stop at stealing data—they put it up for sale on the dark web and even reached out to SCB customers directly, trying to strong-arm the bank into paying up. According to Resecurity, a cybersecurity firm from Los Angeles that got a peek at the stolen data, the attacker’s move to contact clients was a deliberate tactic “of pressing the bank to initiate negotiations.” Those talks, it seems, went nowhere, leaving SCB scrambling. The Central Bank of Seychelles confirmed it was notified of the breach, but neither they nor the Seychelles Police had much to say beyond that, leaving a sense of unease about how prepared the country really is for this kind of attack.
This mess brings Seychelles’ National Cybersecurity Strategy (2019-2024) into sharp focus. The strategy lays out a clear goal: “for Seychelles to be resilient to cyber threats in order to continue leveraging ICT to contribute to national economic and social development.” It’s a noble aim for a country where technology is woven into everything—think telecommunications, transportation, healthcare, and finance. The strategy warns that “the risks associated in cyber-attacks are also ever growing, and threats from unknown sources are dynamic and constantly evolving.” The SCB breach is proof of that, a real-world test of how ready Seychelles is to handle a cyber crisis. Spoiler: it’s got some work to do.
The strategy zeroes in on five key areas: building a strong legal framework, protecting ICT infrastructure, setting up solid organizational structures, developing skilled people, and teaming up with other countries. The SCB breach hits hard on the first two. The goal to “implement measures to protect Seychelles’ cyberspace and ICT infrastructure, to promote resilience to cyber-attacks and to respond to threats” took a hit when the bank’s internet banking platform was exposed. Shutting it down to “contain” the incident, as SCB put it, feels like slamming the door after the thief’s already inside. It’s a sign that the systems in place might not be as robust as they need to be.
Then there’s the organizational side. The strategy calls for a setup that lets different groups—government, businesses, law enforcement—work together seamlessly. That’s where the NCCC comes in, launched on September 3, 2024, at the Ministry of Internal Affairs. This committee, a mix of public and private sector folks, is all about “enhancing coordination, information sharing, and response capabilities to protect essential services.” It’s a big step toward the strategy’s aim to “ensure that Seychelles has the right organizational structure, and processes in place to ensure that organisations can work effectively together.” The NCCC plans to modernize how critical infrastructure is classified and improve how the country responds to cyber threats. The Minister threw his full support behind it, promising to back “the critical work that lies ahead.” But the SCB breach, happening just months earlier, shows how tough that work will be. The bank’s struggle to negotiate with the hacker and the silence from key players like the police suggest coordination is still a weak spot.
The strategy also pushes for a national Computer Emergency Response Team (CERT-SC) to handle cyber incidents. The plan is to start with the Department of ICT (DICT) taking on CERT duties, then spin it off into a standalone body with its own legislation. It’s a smart way to build expertise without stretching resources too thin, but the SCB breach makes you wonder if things are moving fast enough. If CERT-SC had been up and running, could it have helped SCB respond better? The Central Bank’s confirmation of the breach is one thing, but the lack of follow-up from other authorities hints at a system that’s not yet firing on all cylinders.
Seychelles’ reputation as a financial hub adds another layer. The country ranks 45th on the Corporate Tax Haven Index, a nod to its history as a tax haven. While the European Union took Seychelles off its “list of non-cooperative jurisdictions for tax purposes” in 2024, the Central Bank admitted on June 27, 2025, that “money laundering remains a risk, but a number of initiatives are ongoing... to address deficiencies.” The SCB breach, especially with government accounts in the mix, could shake confidence in Seychelles as a safe place to park money. With only seven commercial banks in the country, one slip-up like this can ripple widely.
The human side of cybersecurity is another big piece of the puzzle. The strategy wants “the right people, with the right skills and knowledge to ensure that it has a credible cybersecurity capability.” The SCB hacker’s ability to pull off the breach and then taunt the bank by contacting customers shows just how skilled cybercriminals are these days. Seychelles needs to match that expertise. The NCCC’s push to spread awareness about cybersecurity best practices is a start, but the breach suggests that both the bank and the broader system need to level up their skills—and fast.
Then there’s the global angle. The strategy knows that “cyber-threats can come from anywhere in the world,” so it calls for “effective mechanisms for international co-operation.” Resecurity’s role in analyzing the SCB breach shows why this matters. A small nation like Seychelles can’t go it alone against hackers who operate across borders. But the failed negotiations with the attacker suggest Seychelles needs stronger international ties to handle these situations better.
The strategy’s repeated focus on “best practices in information security and compliance” hits home here. SCB’s breach, described as an “unintentional exposure,” points to gaps in following those practices. The NCCC’s work to promote better standards could help, but it’s going to take time and effort to get everyone on the same page.
The NCCC and the strategy’s goals are signs that Seychelles is taking cybersecurity seriously. The Minister’s promise of “unwavering support” is encouraging, and the push for a CERT-SC shows a commitment to building real capacity. But the SCB breach is a loud wake-up call. It shows the gap between having a plan and making it work. Seychelles is betting big on technology to drive its future, but every step forward comes with new risks. The NCCC, CERT-SC, and the broader strategy are pieces of a puzzle that need to come together quickly to protect the nation’s digital backbone. For a small country with big ambitions, getting this right isn’t just important—it’s everything.

IndraStra Global is now available on
Apple News, Google News, Feedly, Flipboard, and  WhatsApp Channel.

COPYRIGHT: This article is published under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. https://creativecommons.org/licenses/by-nc-nd/4.0/

REPUBLISH: Republish our articles online or in print for free if you follow these guidelines. https://www.indrastra.com/p/republish-us.html