Flutterwave Suffers $7m Security Breach

Flutterwave has experienced a significant security breach, resulting in the unauthorised transfer of about $7 million to various bank accounts. This incident follows closely on the heels of a previous breach, where the company secured a court order to recover $24 million lost due to unauthorised POS transactions.

According to sources within the financial services sector, the breach occurred in April 2024, with perpetrators illegally transferring funds to multiple accounts. Some insiders suggest the amount involved could be as high as $13.5 million.

Flutterwave reportedly acknowledged the breach, stating, “As is common in the financial services industry, there will always be attempts by bad actors to compromise the security of systems set up to protect and monitor services. In April, we detected unauthorised activities inconsistent with usual customer behaviour on one of our platforms used by a small subset of our customer base.”

Flutterwave did not confirm the exact amount stolen but emphasised that no customer funds were lost or compromised, and customer data remained secure. A source revealed that the stolen funds were dispersed across multiple accounts in five financial institutions over four days, strategically keeping deposits below thresholds that would trigger fraud detection systems.

This breach is not an isolated incident for Flutterwave. In February 2023, hackers transferred over ₦2.9 billion from its accounts, and in October 2023, unauthorised POS transactions resulted in the illegal transfer of about $24 million across 6,000 accounts in 35 banks and financial institutions.

The latest breach has been reported to law enforcement, and investigations are underway. Flutterwave has requested Know Your Customer (KYC) details for the accounts involved and has temporarily restricted these accounts as part of the ongoing investigation.

The recurring security issues at Flutterwave highlight the challenges financial technology companies face in safeguarding their systems against increasingly sophisticated cyber threats.