Data as the New Target: Emerging Risks of Digital Theft in Rwanda and Strategies for Prevention.

Data as the New Target: Emerging Risks of Digital Theft in    

                  Rwanda and Strategies for Prevention.         

Ishimwe Sibomana Christian            

University of Rwanda, College of business and economics, Kigali, Rwanda   

Abstract

Rwanda’s rapid digital transformation has significantly increased the reliance of both public and private institutions on data-driven systems, making digital information a critical national asset. As digital infrastructure expands, so too does the risk of data theft, cyber fraud, and unauthorized data exploitation. This study examines the emerging risks of digital theft in Rwanda, with a particular focus on vulnerabilities within institutional data governance frameworks. The paper adopts a qualitative policy-analysis approach, drawing on existing legislation, national ICT strategies, institutional reports, and relevant academic literature to assess Rwanda’s preparedness to prevent and respond to data-related crimes. The findings suggest that while Rwanda has made notable progress in establishing legal and institutional frameworks for data protection and cybersecurity, gaps remain in enforcement capacity, public awareness, inter-agency coordination, and technical readiness. Furthermore, the study identifies key risk factors, including weak organizational controls, low cybersecurity literacy, and increasing dependence on mobile and cloud-based services. The paper proposes a set of governance-oriented prevention strategies, including strengthening regulatory oversight, improving institutional accountability mechanisms, investing in cybersecurity capacity-building, and promoting data protection awareness at both organizational and citizen levels. The study concludes that data theft represents a growing systemic risk to Rwanda’s digital economy and that proactive governance reforms are essential to ensure digital trust, economic stability, and national security in the evolving information age.

Keywords

Data Governance; Digital Theft; Cybersecurity; Data Protection; Privacy Law; Cybercrime; Digital Economy; Information Security; E-Government; Rwanda

                          I .Introduction  

Rwanda’s development strategy has prioritized rapid digital transformation as a vehicle for inclusive growth, service delivery, and public-sector efficiency. Over the last decade the country has implemented a suite of digital platforms and identity systems most notably the government e-services gateway (Irembo) and national digital identity initiatives that have moved a wide range of civic and commercial interactions into online environments. These developments have made structured personal and institutional data an essential national asset and, consequently, an attractive target for malicious actors. Digital Impact Alliance+1

At the same time, Rwanda’s exposure to cyber incidents is no longer hypothetical. In February 2020, a coordinated attack brought a Rwandan government-hosted data center offline and disrupted multiple public websites, illustrating how breaches of infrastructure can affect public service availability. More recently, large regional service providers have disclosed cybersecurity incidents involving unauthorized access to customer personal information events that highlight risks associated with centralized service providers and third-party data processing in the region. These episodes demonstrate that both public-sector and private-sector digital assets in Rwanda are susceptible to compromise, whether through targeted attacks against infrastructure or unauthorized access to customer records. Data Center Dynamics+1

Rwanda has responded institutionally by developing governance instruments and operational frameworks intended to reduce cyber risk and improve incident readiness. The National Cybersecurity Strategy and related regulatory instruments set out baseline expectations for risk management, critical-infrastructure protection, and cross-agency coordination; similarly, the Data Protection and Privacy Office (DPO) has established notification procedures and compliance mechanisms designed to strengthen accountability for personal data handling. Nevertheless, official frameworks and policy instruments, while necessary, are only part of an effective defense posture: enforcement gaps, uneven technical capacity across organizations, and limited public awareness continue to create systemic vulnerabilities. NCSA+2dpo.gov.rw+2

This paper argues that traditional conceptions of “theft” in Rwanda are being transformed by the digitalization of economic and governmental systems: whereas physical theft remains salient, data theft defined as unauthorized acquisition, exfiltration, or misuse of personal and institutional information constitutes an emergent form of crime with distinct governance, technical and social implications. Using a policy-analysis approach that triangulates legislative texts, institutional guidance, documented incident reports, and scholarly literature, the study seeks to (1) map the major vectors and modalities of digital theft affecting the Rwandan context, (2) assess the strengths and weaknesses of existing governance and technical arrangements, and (3) propose a set of integrated prevention and mitigation strategies grounded in data-governance principles. By focusing on the intersection of governance, technology and behavior, the paper aims to inform both academic debates and practical policy choices needed to preserve digital trust and national resilience. Digital Impact Alliance+1

                            II. FINDINGS

1. Mapping major vectors and modalities of digital theft in the Rwandan context.

Digital theft in Rwanda manifests through a mix of global attack techniques and localized modalities shaped by national infrastructure, service-delivery models, and market structure. Below I map the principal vectors and give Rwanda-specific examples or contextual evidence.

1.1. External infrastructure attacks (DDoS, data-center targeting, supply-chain disruption)

Mass availability attacks and hostile access to shared infrastructure have real precedents in Rwanda. In February 2020 a data center hosting government and private-sector servers was rendered unavailable after a coordinated attack, causing multiple government websites to go offline and demonstrating the outsized risk that attacks against shared infrastructure pose to national service continuity. Such incidents show that attackers can weaponize availability disruption to indirectly exfiltrate or leverage data access elsewhere. Data Center Dynamics+1

1.2. Credential compromise and account takeover (phishing, credential stuffing, “stealer” malware)

Credential theft via phishing, credential stuffing, and malware that harvests saved passwords is a pervasive vector worldwide and a growing problem in Rwanda as government and commercial services centralize authentication (e.g., single sign-on for e-services). Recent analyses of regional malware/stealer logs have shown compromised credentials across government domains, including high-value services. These compromises enable account takeover, impersonation, and downstream data exfiltration. Cyfirma+1

On 23 September 2025, a threat actor using the alias “koko” advertised a 53 GB data dump, allegedly from the Government of Rwanda Ministry of Health, on a dark web forum (Seller’s Place). The package, tied to hmis.moh.gov.rw, reportedly contains documents, CVs, emails, and SQL files and is being sold for $2,500, a compromise that could expose sensitive health records, personnel information, and operational data if verified.

On 25 May 2025, a Telegram post by user “Deleted Account” publicly called for a distributed-denial-of-service (DDoS) against the National Bank of Rwanda website (www.bnr[.]rw / https://www.bnr[.]rw/), stating: “Yo y’all hop in ddos this website I’m attacking it rn.” The message potentially constitutes an open solicitation and admission of an ongoing attack against the bank’s online infrastructure.

On 4 May 2025, a post surfaced on Telegram, allegedly made by the Vasa Locker Affiliate (Babuk Locker 2.0), claiming responsibility for breaching the Rwandan Ministry of Health (moh.gov.rw). The actor stated that approximately 52GB of data had been exfiltrated from multiple Ministry websites, including the Rwanda Health Workforce Management System. The post included a message asserting full access to ministry systems and data theft.

The same claim was reshared on Raidforums on 4 May 2025 under the Discussion section, amplifying the visibility of the incident across cybercriminal communities.

Between February and March 2025, several archive files associated with Rwandan government domains cheno.gov.rw.zip, cnlg.gov.rw.zip, nurc.gov.rw.zip, and yego.gov.rw.zip were observed circulating on cybercriminal platforms.

Rwanda government data leak timeline & summary:

• 24 Nov 2023 – Original leak posted: User hacxx publishes “Database Leaked 2023 [Full Bac]” on a dark forum, listing cheno.gov.rw, cnlg.gov.rw, nurc.gov.rw, yego.gov.rw; dataset described as 329 MB, SQL format, CMS: Custom.
• 14 Feb 2025 – Resurfaced on Telegram & Raidforums: The four archive files (cheno.gov.rw.zip, cnlg.gov.rw.zip, nurc.gov.rw.zip, yego.gov.rw.zip) are first observed circulating on Telegram (channel “Babuk 2.0 Ransomware Affiliates”) and posted to Raidforums | Discussion.
• 23–27 Feb 2025 – Repeated reposts: The same archives are reposted multiple times within the same Telegram channel, indicating renewed interest or repackaging efforts.
• 02–03 Mar 2025 – Cross-channel distribution: Files are shared across additional Telegram channels, including Babuk 2.0 Ransomware Affiliates and REX, broadening exposure among ransomware-affiliated communities.
• 10 Mar 2025 – Amplification by affiliates: The archives are again circulated by Vasa Locker Affiliate (Babuk Locker 2.0), Babuk 2.0 Ransomware Affiliates, REX, and reposted on Raidforums | Discussion, demonstrating coordinated amplification by multiple affiliate groups.

The content resurfacing in February–March 2025 traces back to a documented 2023 breach. Threat actors and ransomware-affiliated channels appear to have repackaged and re-amplified the older dataset to maintain visibility and monetize the leak. The consistent reposting across Telegram ransomware channels and underground forums indicates a coordinated campaign leveraging historical data from Rwandan government systems, with Babuk Locker 2.0 and its affiliate networks playing a key role in the propagation.

On 11 January 2025 at 21:55:28, a mirror cache of https://www.oes.naeb.gov.rw/ynr.html was saved and notified by ynR, showing evidence of a possible defacement; the record lists the host IP as 197.243.23.144 (Rwanda), system Linux, and identifies the page as a cached snapshot of the site in its compromised state, indicating unauthorized modification of a NAEB (Government of Rwanda) subdomain.

On 10 January 2025 at 23:17:14, a mirror cache of https://eralis.minagri.gov.rw/ynr.html was saved and notified by ynR, indicating a possible defacement of the Ministry of Agriculture and Animal Resources (MINAGRI) subdomain; the snapshot lists the IP address 197.243.19.232 (Rwanda), running on a Linux system, serving as evidence of unauthorized modification to a Rwandan government website.

On 25 August 2025, a post appeared on a dark web forum by a user identified as hulky (V.I.P), advertising a database titled “Mix Countries Crypto Leak.” The dataset reportedly contained 6.3 million records of names, emails, phone numbers, and countries, with 141 entries associated with Rwanda. The seller claimed to have removed duplicates and offered the data for sale with escrow and middleman options, providing a Telegram contact for further inquiries and sample verification.

Between February and March 2025, initial leaks of several Rwandan government archive files, including cheno.gov.rw.zip and cnlg.gov.rw.zip, were observed circulating on cybercrime platforms. By August 2025, stealer logs from malware families, such as Acreed, Rhamadanthys, and Vidar, began revealing credentials associated with the Rwandan government and telecom networks, indicating a shift from data leakage to active credential compromise. In October 2025, broader exposure was confirmed as multiple .gov.rw domains across public sector systems were identified with compromised credentials, underscoring a sustained and escalating threat to Rwanda’s government infrastructure.

1.3. SIM-swap and telecom-enabled fraud (mobile money & identity fraud)

Rwanda’s economy relies heavily on mobile platforms and electronic payment conditions that make SIM-swap and telecom enabled fraud particularly attractive. Telecommunication incidents involving customer personal information (announced by large regional operators) and regulatory actions against telecom practices reveal both the exposure of telecom data and the governance questions around cross-border hosting and processing of sensitive data. MTN Group+1

1.4. Insider threat and weak organizational controls

Data governance literature underscores that insiders malicious or negligent are consistently a major source of data loss. In contexts where governance and technical controls are uneven across organizations, insider misuse or accidental exposure (misconfiguration, weak access control) amplifies the risk of large-scale data leakage. Rwanda’s rapid digitalization combined with variable institutional capacity creates conditions for insider-driven incidents unless governance controls are rigorously applied. This observation aligns with classical security studies on the human factor. Computer Laboratory+1

1.5. Third-party and cloud/outsourcing risks (supply-chain compromises)

Government and private entities increasingly depend on third-party vendors and cloud services. Cross-border hosting and outsourcing create both legal jurisdictional issues and an expanded attack surface: when vendors or regional providers are compromised, data belonging to Rwandan entities may be exfiltrated or exposed. Regulatory scrutiny of cross-border processing and the RURA ruling against certain off-shore IT operations highlight the governance relevance of this vector. MAfrica Business Communities+1

Rwanda’s telecom industry regulator has fined MTN Rwanda Rwf7 billion (approx. $8.5 million) for running its IT services outside the country in breach of its license.

The Rwanda Utilities Regulator Authority (RURA) announced the decision on May 17 ,2025 . It said in a ruling posted on its website that MTN Rwanda was hosting its IT services hub in Uganda, which RURA had prohibited.

“They are being punished for relocating their IT services outside Rwanda, and this was deliberate,” RURA Spokesman Anthony Kulamba said.

Kulamba said: “MTN Rwanda Ltd provided services in contravention of Enforcement Notice and Directives issued by the Regulator against hosting its IT services outside the country. By doing so, MTN Rwanda breached its license obligation requiring it to comply with all applicable laws, regulations and any other regulatory instruments issued by the competent authority. On 4th May 2017, the Regulatory Board of RURA conducted a hearing session in which MTN Rwanda Ltd was informed of the breach of its license obligations and given the opportunity to be heard, whereby MTN Rwanda Ltd admitted the above-mentioned breach”.

MTN Rwanda, a division of South Africa’s MTN Group, is Rwanda’s leading mobile operator, with four million subscribers. It is 80 percent owned by MTN Group while the remaining 20 percent is listed on the Rwanda Securities Exchange.

MTN Group confirmed receipt of a notification about the fine and said it has been in discussion with the regulator.

“MTN has been engaging with the regulator on this matter over the past four months. MTN Rwanda is currently studying the official notification and will continue to engage with the regulator on this matter,” it said in a statement.

Telecom sector watchers have been analyzing the RURA decision and comparing it with a US$600 million fine imposed by the Nigerian government for not disconnecting unregistered SIM cards. It paid 30 billion naira ($95.24 million) in March 2025.

1.6. Social engineering and targeted deception

Social engineering remains a force multiplier for many technical attacks: attackers who successfully manipulate staff or users bypass otherwise robust technical measures. Foundational security texts emphasize that the human element is frequently the weakest link; Rwanda’s expanding public digital services increase the pool of potential social-engineering targets, from frontline clerks to citizens using e-services. SciSpace+1

2. Assessment of strengths and weaknesses in Rwanda’s existing governance and technical arrangements

This section summarizes institutional, legal and technical capacities as strengths, and highlights critical weaknesses that the findings above make salient.

2.1. Strengths

A. Modern legal framework and institutional bodies

Rwanda enacted a modern legal instrument for personal data protection (Law n°058/2021) and established a Data Protection & Privacy Office (DPO) with breach-reporting mechanisms and compliance guidance; this provides a legal backbone for accountability and rights-based remedies. The DPO’s public resources and reporting channels are concrete governance assets. Rwandalii+1

B. National cybersecurity strategy and institutionalization

The Government has formalized cybersecurity planning (National Cybersecurity Strategic Plan and a National Cyber Security Authority) that sets out protection of critical infrastructure, incident response, and coordination objectives for 2024–2029. Such high-level plans are essential foundations for coordinated action. Minict+1

C. Public-sector digital platforms adopting standards

Key platforms (for example, Irembo) have advanced technical compliance (PCI-DSS for payments, data-controller accreditation), indicating that major national e-services can and do adopt strong technical controls when prioritized. This shows pockets of good practice that can be scaled. Irembo+1

D. Regulatory activity and enforcement potential

Regulatory action (e.g., RURA’s enforcement on IT hosting practices) demonstrates that authorities are willing to act against non-compliant conduct an important governance signal that can deter lax vendor practices. MAfrica Business Communities

2.2. Weaknesses / gaps

A. Enforcement and capacity shortfalls

Having laws and strategies does not guarantee enforcement. Reports and academic reviews of national cyber readiness indicate gaps in technical capacity, limited skilled personnel, and variable implementation across agencies weaknesses that create windows of opportunity for attackers. The DPO’s existence is positive, but enforcement resources and technical investigative capacity are not yet uniformly strong across institutions. Data Protection Office Rwanda+1

B. Heterogeneous organizational controls and maturity

Many organizations, especially smaller private firms and local government units lack mature data governance programs. Data governance literature stresses that an organizational program (roles, policies, data inventories) is necessary to control risk; absent or immature programs mean inconsistent access controls, logging, and breach readiness. ScienceDirect

C. Reliance on centralized services with cross-border dependencies

The centralization of services and the use of regional cloud/hosting arrangements increase systemic risk: a single vendor compromise can affect multiple Rwandan services. The MTN group incidents and regulatory scrutiny over off-shore hosting underscore the tension between operational efficiency and sovereign data control. MTN Group+1

D. Low public awareness and the persistent human factor

Social-engineering risks and low levels of cybersecurity literacy among general users and some staff amplify susceptibility to phishing and credential theft. Foundational security texts highlight that without ongoing awareness and testing, technical controls are often defeated by human actions. SciSpace+1

E. Fragmented incident reporting & transparency

Although breach-reporting channels exist (DPO), transparency about incidents and public reporting remains uneven. This impedes sector-wide learning and reduces the ability of researchers and other organizations to map threat trends. International best practice encourages mandatory, timely reporting and anonymized data sharing for resilience; implementation remains work in progress. Data Protection Office Rwanda+1

3. Integrated prevention and mitigation strategies grounded in data-governance principles

Effective prevention must combine the “people, processes, technology” triad of data governance with national-level policy measures. Below are prioritized, integrated recommendations that align with both domestic strategy and established governance/security literature.

3.1. Build and enforce tiered data governance programs across sectors

Require organizations that process high-value or sensitive data (government agencies, payment platforms, telecoms, health providers) to implement certified data governance programs: appointed data stewards, inventories, classification, retention policies, and documented access controls. Guidance from established data-governance practice (e.g., Ladley; “Data Governance”) can be adapted into sectoral certification thresholds. A mandatory, phased compliance timetable with independent audits would raise baseline maturity. ScienceDirect+1

3.2. Strengthen incident detection, mandatory reporting, and information-sharing mechanisms

Operationalize abuse/incident reporting into a mandatory, time-bound scheme (for both public & private sectors) with anonymized threat indicators shared via a national CERT (computer emergency response team). Centralized but privacy-aware sharing accelerates detection of credential campaigns and stealer malware patterns. The DPO’s reporting mechanisms can be integrated into this flow to preserve rights while enabling rapid response. Data Protection Office Rwanda+1

3.3. Prioritize protection of shared infrastructure and supply-chain governance

Implement minimum security standards and contractual obligations for vendors and colo/hosting providers serving government and critical services requirements for baseline logging, encryption at rest and transit, vulnerability disclosure, and on-site audits. Regulator oversight (RURA, NCSA) should include vendor certification and constraints on off-shore hosting for certain classes of sensitive data unless equivalent protections and cross-border agreements exist. This reduces systemic exposure from vendor compromises. MAfrica Business Communities+1

3.4. Invest in human-centered defenses training, social-engineering simulations, and resilient processes

Technical controls must be complemented by regular staff training, phishing simulations, role-based access reviews, and strict on/off-boarding processes to reduce insider and social-engineering risk. Security literature stresses the centrality of the human factor; a national program of awareness (targeting both citizens and front-line civil servants) should be part of the cyber strategy. SciSpace+1

3.5. Adopt technical best practices: zero-trust, multi-factor authentication, encryption & logging

Promote zero-trust architectures for sensitive systems, require multi-factor authentication (MFA) for e-services and privileged accounts, mandate end-to-end encryption for sensitive datasets, and require immutable logging/forensics readiness. Evidence from secure platform adoptions (PCI-DSS compliance on national gateways) demonstrates these measures are feasible and effective when enforced. Irembo+1

3.6. Legal & regulatory refinements: stronger sanctions, breach disclosure, and data-localization policy where justified

Strengthen enforcement capacity around the Data Protection Law, including proportionate sanctions for negligent processors and clear breach disclosure rules. Where national interest or sensitive categories are involved, consider narrowly-scoped data localization or equivalence requirements for third-party processors balanced against interoperability and operational efficiency. Regulatory action should be transparent, rules-based and accompanied by international cooperation agreements. Rwandalii+1

3.7. Capacity building & ecosystem development: education, market incentives, and cyber insurance

Scale technical capacity via university programs, certified professional training, and public-private apprenticeships. Incentivize security investment through procurement preferences, cyber-insurance markets, and public recognition schemes for certified providers. Developing in-country capability reduces reliance on external vendors and raises national resilience. Minict+1

III. CONCLUSION

This study set out to examine the emerging threat of digital theft in Rwanda by mapping key attack vectors, assessing existing governance and technical arrangements, and proposing integrated data-governance based countermeasures. The findings demonstrate that data theft in Rwanda is no longer a hypothetical future risk but a present and evolving challenge shaped by increasing digital dependence, centralized service delivery models, third-party outsourcing, and uneven institutional capacity. Incidents affecting government infrastructure and telecom operators confirm that Rwanda’s digital assets are now being targeted in patterns similar to those observed in more technologically mature economies.

Rwanda has made commendable progress in establishing foundational governance instruments, including a modern data protection law, a national cybersecurity strategy, and dedicated regulatory institutions. These efforts indicate a clear political and institutional recognition of cyber risk as a development priority. However, the analysis shows that regulatory frameworks alone are insufficient if not consistently enforced, operationalized across institutions, and complemented by strong technical controls and public awareness. Gaps remain in incident transparency, cross-agency coordination, organizational governance maturity, and skilled cybersecurity personnel, creating an enabling environment for data theft to persist.

Crucially, the findings highlight that digital theft in Rwanda is not purely a technical problem but a governance challenge. Weak internal controls, third-party vulnerabilities, low cyber literacy, and inconsistent enforcement are governance failures that manifest as security incidents. Effective response therefore requires more than investment in technology; it demands institutional accountability, enforceable standards, and organizational cultures that treat data as a strategic asset requiring protection equivalent to physical or financial resources.

This paper concludes that Rwanda’s long-term digital resilience depends on embedding data governance at the core of its cybersecurity strategy. Integrated approaches such as mandatory breach reporting, vendor certification, tiered data governance programs, zero-trust architectures, and continuous capacity building are essential to convert legal intent into operational protection. In addition, strengthening public awareness and developing local technical expertise will be critical to reducing social engineering risks and dependency on external service providers.

Ultimately, as Rwanda advances toward a fully digital economy, the question is not whether data theft will continue to occur, but whether institutions will be adequately prepared to detect, contain, and recover from it. Proactive governance reform, institutional coordination, and sustained investment in human and technical capacity will determine whether data becomes a source of national vulnerability or a secure foundation for economic transformation. The choices made today will define whether Rwanda’s digital future is resilient, trustworthy, and sustainable.

Acknowledgement

The author acknowledges MTN Rwanda and Irembo Ltd for their publicly available disclosures and digital service practices that informed this study. Appreciation is also extended to the Data Protection and Privacy Office (DPO) and the Rwanda Utilities Regulatory Authority (RURA) for regulatory guidance and policy resources. The author further thanks RISA for national ICT strategy documentation. Finally, gratitude is expressed to scholars and practitioners whose work strengthened the academic foundation of this research.

References

Rwanda Laws, Policies & Official Documents

• Government of Rwanda. (2021). Law No. 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy. Official Gazette of the Republic of Rwanda.
• Ministry of ICT and Innovation (MINICT). (2023). National Cybersecurity Strategic Plan (2024–2029). Government of Rwanda.
• Data Protection and Privacy Office (DPO). (2022). Guidelines on Personal Data Protection and Privacy in Rwanda. Government of Rwanda.
• Rwanda Utilities Regulatory Authority (RURA). (2023). ICT Regulatory Framework and Compliance Guidelines. Government of Rwanda.
• Rwanda Information Society Authority (RISA). (2022). Smart Rwanda Master Plan Implementation Report. Government of Rwanda.
• National Institute of Statistics of Rwanda (NISR). (2023). ICT and Digital Economy Indicators Report. Kigali: NISR.

Rwanda-Specific Data Breaches & Cyber Events

• New Times Rwanda. (2020). Government websites disrupted after cyberattack on national data center Kigali: The New Times.
• MTN Group. (2024). Cybersecurity incident disclosure and customer data protection statement. MTN Annual Report.
• Data Protection and Privacy Office (DPO). (2024). Public Notice on Personal Data Breach Management and Reporting Obligations. Kigali.
• RURA. (2023). Decision on Cross-border Hosting and Regulatory Compliance for ICT Providers. Kigali.

Books & Academic Literature (Data Governance & Cybersecurity)

• Ladley, J. (2012). Data Governance: How to Design, Deploy, and Sustain an Effective Data Governance Program. Burlington, MA: Morgan Kaufmann.
• Anderson, R. (2020). Security Engineering: A Guide to Building Dependable Distributed Systems (3rd ed.). Wiley.
• Mitnick, K. D., & Simon, W. L. (2003). The Art of Deception: Controlling the Human Element of Security. Wiley.
• Solove, D. J. (2004). The Digital Person: Technology and Privacy in the Information Age. New York: NYU Press.
• OECD. (2015). Digital Security Risk Management for Economic and Social Prosperity. OECD Publishing.
• World Bank. (2023). Cybersecurity in Digital Transformation: Policy and Institutional Frameworks for Developing Economies. Washington, DC.

International Cybersecurity Authorities

• International Telecommunications Union (ITU). (2023). Global Cybersecurity Index Report. Geneva.
• European Union Agency for Cybersecurity (ENISA). (2022). Threat Landscape Report. Brussels.
• NIST. (2018). Cybersecurity Framework Version 1.1. National Institute of Standards and Technology, USA.

Digital Platforms & Institutional Sources

• Irembo Ltd. (2023). Platform security and compliance overview. Kigali.
• MTN Rwanda. (2024). Data Protection and Privacy Policy. Kigali.
• Data Protection and Privacy Office (DPO). (2023). Data Controller Registration Guidelines. Kigali.