Malawi loses K700m in NOCMA cyber heist

…hackers hijack fuel supplier emails

Malawi has suffered a K700 million blow after hackers duped the National Oil Company of Malawi Limited (NOCMA) into wiring $403,605 to a fraudulent account in a brazen cyber heist.

The attackers reportedly hijacked email communications from Mozhandling Limited, a Mozambican firm contracted to handle Malawi’s fuel shipments through the Port of Nacala, before posing as the company and submitting fake banking details.

Nocma confirmed the heist today, saying the Malawi Police Service and Bank of America have launched investigations to trace the diverted funds.

The fraudsters claimed Mozhandling had opened a new account with Bank of America, convincing Nocma to instruct the National Bank of Malawi on April 29, 2026 to transfer the money.

The scam was only uncovered two weeks later when the genuine Mozhandling representative contacted Nocma demanding payment.

Nocma management has admitted that weaknesses in its controls contributed to the loss, with the loopholes emerging after government introduced the Government-to-Government fuel procurement model before full operational and cybersecurity procedures were in place.

Following a return to the Open Tender System, NOCMA says it is now auditing its payment verification controls while working with law enforcement agencies to recover the money.

NOCMA now faces tough questions over whether it followed basic due diligence before authorizing the payment.

The company appears to have relied on altered email communication and newly supplied banking details without adequately verifying the changes through independent channels.

For an institution handling millions of dollars in public funds, such a lapse raises serious concerns about the strength of its payment controls, internal checks and accountability.