CoCCA Breach Affected 44 Sierra Leonean .sl Website Addresses

Sierra Leone was among several countries affected by a cybersecurity breach involving the international CoCCA domain management system, according to the Ministry of Communication, Technology and Innovation.

The unauthorized access, which occurred on September 25, 2026, affected the national domain system used to manage website addresses ending in “.sl”. The Ministry said 44 Sierra Leonean website addresses were involved, including one Government website and several commercial websites.

CoCCA is an international platform used to administer internet domain names. The affected .sl addresses are used by Government institutions, private businesses and other organisations operating in Sierra Leone.

Potential redirection risk

The Ministry said the breach created a potential risk that people trying to visit legitimate websites could instead be directed to fraudulent platforms controlled by cybercriminals. It did not state that users were actually redirected or report any confirmed financial, operational or user impact.

The identities of those responsible and the precise method used to gain access have not been disclosed.

Domains restored within hours

Government authorities said the incident was detected and contained on the day it occurred. All 44 affected website addresses were restored to their correct configurations within hours.

The Ministry also said immediate security measures were introduced to block further unauthorized access, remove the identified threat and strengthen the protection of the domain management infrastructure.

A subsequent security assessment found no evidence of continuing unauthorized access as of October 8, 2026, according to the Ministry.

Investigation continues

Investigations remain underway into how the attackers entered the international system and whether other vulnerabilities could place Sierra Leone’s digital infrastructure at risk in the future.

The Ministry said it is working with local and international partners to monitor the system and assess emerging security risks. It also said additional safeguards would be introduced to reduce the likelihood of a similar incident.

The Ministry cited a Google security report published on October 6, 2026, which identified Sierra Leone, Ghana and American Samoa among countries affected by the wider series of cyberattacks involving the same domain management infrastructure.

The Government reaffirmed that protecting the country’s digital infrastructure remains a priority and said the public would be updated on significant developments from the ongoing investigations.