URGENT CYBERSECURITY WARNING CRIMINALS HAVE MOVED FROM THE STREETS TO YOUR COMPUTERS AND MOBILE PHONES

OPEN LETTER TO ZIMBABWEAN BUSINESSES AND ORGANISATIONS

TO: Board Chairpersons, Chief Executive Officers, Managing Directors, Company Secretaries, Business Owners, Heads of Public Institutions and Leaders of Non-Governmental Organisations

SUBJECT: URGENT CYBERSECURITY WARNING CRIMINALS HAVE MOVED FROM THE STREETS TO YOUR COMPUTERS AND MOBILE PHONES

Dear Business Leaders and Heads of Organisations,

I write in my capacity as Chief Executive Officer of Hansole, an organisation providing cybersecurity, information technology and digital services and as an engineer and cybersecurity advocate who has spent years promoting cybersecurity awareness, education and corporate governance in Zimbabwe.

My concern is simple but urgent, criminals have changed the way they operate, yet many of our businesses and institutions have not adapted their security systems, management practices and investigative capabilities quickly enough to confront this new reality.

Traditionally, criminals needed to physically enter business premises, break into offices, threaten employees or steal cash and property. Today, a criminal can potentially steal millions of dollars without ever setting foot inside the organisation being targeted. Armed with nothing more than a computer, mobile phone and internet connection, cybercriminals can compromise financial systems, impersonate senior executives, manipulate electronic transactions, steal confidential information and defraud unsuspecting customers.

The new crime scene is digital, and every Zimbabwean business must recognise that it could be a target. Unlike conventional crime, cybercrime often leaves no immediately visible physical evidence. The evidence may exist entirely within electronic communications, compromised email accounts, mobile devices, banking transaction records, computer networks and digital identities. In many cases, perpetrators operate from outside Zimbabwe, making investigations, prosecution and the recovery of stolen funds considerably more complex.

A criminal operating thousands of kilometres away can target a Zimbabwean company within seconds. By the time the organisation discovers the breach, stolen funds may have passed through multiple accounts, payment platforms or international jurisdictions.

Zimbabwe’s economy is increasingly dependent on internet banking, mobile money, electronic payments, online procurement, digital communications and cloud-based business systems. While these technologies create enormous economic opportunities, they also introduce vulnerabilities that cybercriminals are actively exploiting.

Are Zimbabwean businesses adequately equipped to detect and prevent sophisticated cyberattacks? Are employees sufficiently trained to recognise digital fraud? Do our boards of directors understand the cybersecurity risks facing their organisations? And do our law enforcement institutions possess the specialist capabilities necessary to investigate increasingly complex cybercrimes? These questions deserve your serious attention at the highest levels of corporate leadership and national governance.

Cybersecurity must become a boardroom responsibility. Through my professional work in cybersecurity awareness and training, I have had the opportunity to provide cybersecurity training to boards and senior leadership, including those associated with FBC Holdings and the Zimbabwe Stock Exchange (ZSE), as well as board members through the Institute of Directors Zimbabwe (IoDZ).

These engagements have reinforced my conviction that cybersecurity cannot be left entirely to information technology departments. Cybersecurity is fundamentally a corporate governance, financial risk, business continuity and institutional accountability issue. Board members and chief executives must understand that a successful cyberattack can have consequences extending far beyond the immediate loss of money. It can undermine shareholder value, destroy customer confidence, expose confidential business information, interrupt operations and cause lasting reputational damage.

We cannot effectively confront twenty-first-century digital crime using security strategies developed primarily for traditional criminal activity.

Reporting a cybercrime to the police does not automatically guarantee the recovery of stolen funds. Installing a firewall does not eliminate the risk of an employee being deceived into authorising a fraudulent transaction. Similarly, implementing two-factor authentication, while essential, does not provide complete protection against sophisticated phishing, social engineering, account compromise or artificial intelligence-enabled fraud.

Every board of directors should be asking management one fundamental question, “If our organisation were attacked today, would we be capable of detecting the attack, containing the damage, preserving evidence and recovering our operations?”

If their answer is, “ uncertain”, then cybersecurity deserves immediate attention.

My involvement in cybersecurity advocacy extends beyond corporate training. I initiated the Zimbabwe National Cyber Security Conference, an initiative intended to bring together government institutions, business leaders, cybersecurity professionals, financial institutions and other stakeholders to strengthen national awareness and preparedness against emerging digital threats.

I am encouraged that this conference initiative has subsequently been adopted by Zimbabwe’s Ministry responsible for Information and Communication Technology, demonstrating the importance of institutionalising cybersecurity awareness at the national level.

I am also the author of the Zimbabwe National Cyber Security Booklet, developed to promote understanding of cybersecurity threats, digital risks and the practical measures that individuals and organisations can take to protect themselves.

My academic and professional background combines engineering, information technology, cybersecurity and management. I hold an MBA, Bachelor of Engineering (BEng) in Electronics Engineering and Management, together with UK qualifications including a Certificate in Understanding Data Protection and Data Security and a Certificate in Principles of Cyber Security among several other qualification.

These qualifications, combined with my experience in cybersecurity advocacy, corporate training, engineering and technology services, have strengthened my belief that digital security must be approached as both a technical and a leadership responsibility.

Urgent measures every Zimbabwean organisation must take. I strongly urge Zimbabwean businesses and organisations to implement the following measures:

1. Strengthen cybersecurity leadership and accountability. Boards of directors must ensure that cybersecurity is included in organisational risk management frameworks. Qualified cybersecurity professionals should be engaged to assess vulnerabilities, identify threats and implement appropriate safeguards.

2. Secure financial transactions and payment systems. Businesses must establish strict procedures for verifying electronic payment instructions, particularly requests involving changes to supplier banking details, large financial transfers or urgent instructions supposedly issued by senior executives.

3. Invest in cybersecurity awareness and training. Employees, managers and directors must receive regular training to recognise phishing emails, fraudulent WhatsApp messages, executive impersonation, social engineering and AI-generated deception. Training should be practical, continuous and appropriate to the responsibilities of each employee.

4. Protect customer information and organisational data. Organisations must implement strong access controls, secure authentication, regular software updates, tested data backups and effective information protection procedures.

5. Establish effective cyber incident response procedures. Every organisation should have a documented and tested incident response plan covering the detection, containment, investigation and recovery stages of a cyberattack, including the preservation of digital evidence.

6. Strengthen cooperation with law enforcement and regulators. Financial institutions, telecommunications operators, businesses, cybersecurity professionals and law enforcement agencies must collaborate to improve cybercrime reporting, fraud prevention, digital evidence handling and international investigations.

Zimbabwe must strengthen its cybercrime investigation capabilities. I also call upon the Government of Zimbabwe, law enforcement institutions and relevant regulatory authorities to continue investing in specialised cybercrime investigation capabilities, digital forensic expertise and international cooperation.

Modern cybercrime investigations require knowledge of computer networks, mobile technologies, electronic communications, digital payment systems, cloud infrastructure and the sophisticated methods employed by cybercriminals.

A police officer investigating a cybercrime may require entirely different technical resources and specialist support from those needed to investigate a conventional robbery or burglary.

Without the appropriate technical capabilities, even cases involving substantial digital evidence may prove difficult to investigate successfully.

The business community must also recognise that cybercrime is not restricted to major corporations or financial institutions.

Small businesses, schools, churches, charities, non-governmental organisations, professional associations and individual entrepreneurs are equally vulnerable.

A compromised WhatsApp account can be used to defraud customers. A fraudulent email can redirect payments into a criminal’s bank account. A stolen customer database can expose thousands of individuals to identity theft. A ransomware attack can interrupt operations and threaten the survival of an organisation.

For smaller businesses operating with limited financial reserves, a single serious cyber incident can be financially devastating.

As Chief Executive Officer of Hansole, and as someone who has worked to advance cybersecurity awareness through professional training, national initiatives and educational publications, I firmly believe that Zimbabwe has the opportunity to build a stronger and more secure digital economy.

However, achieving this objective requires leadership, investment, professional competence and a willingness to recognise that cybersecurity is no longer optional.

Cybersecurity expenditure must not be viewed merely as an additional operating cost. It is an investment in business continuity, financial protection, shareholder value, customer confidence and national economic resilience.

Our banks, businesses, schools, public institutions and organisations must develop a culture in which cybersecurity awareness, preparedness and accountability become part of everyday operations.

The criminals have adapted to the digital age. Zimbabwe’s businesses, organisations and law enforcement institutions must adapt with equal determination.

The question is whether your organisation is sufficiently prepared to prevent, detect, respond to and recover from a cyberattack.

I appeal to every board chairperson, chief executive officer, managing director, company secretary and business owner to make cybersecurity a standing item on the boardroom agenda.

Let us protect our businesses, our customers, our livelihoods, our shareholders and the future of Zimbabwe’s digital economy.

The time to act is now not after the money has disappeared, customer information has been stolen or an organisation’s reputation has been destroyed.

For more details please WhatsApp +263772278161

Yours faithfully,

ENGINEER JACOB KUDZAYI MUTISI
Chief Executive Officer – Hansole
Cybersecurity Advocate