# Letshego Ghana — dossier & attack-vector analysis
Date: 2026-08-14. Method: public OSINT + engagement data (tottot_* DBs, kowri).
CONFIRMED = sourced/DB-verified; PROBABLE = inference.

## DOSSIER

### Identity
- Letshego Ghana Savings and Loans PLC. Opened Sept 2010 as African Financial
  Services (AFS), rebranded African Finance Business (AFB) 2013, now Letshego.
- Parent: Letshego Holdings Ltd, Botswana (listed Botswana Stock Exchange,
  Reg Co.98/442). Group CEO Reinette van der Merwe.
- HQ: Ground & 2nd Floor, Allied Heights, Abelemkpe, Accra (also 4th Floor,
  Cocoshe House, Agostino Neto Rd, Airport City). Tel +233 302 208 333.
- Staff: 200+ employees. GSE-listed.

### Business / products
- Mobile loans, payroll loans, group loans, impact lending. Flagship:
  **QWIKLOAN** — MTN Ghana mobile-money short-term loans (GHS 25–1,000),
  partnership with MTN Ghana + JUMO; hit 1M customers milestone.
- USSD loan channel *899*17# (matches the live ussd_journey data we hold).
- Funding: GHS 500M Medium-Term Note programme on GSE (expanded from GHS 300M,
  Jan 2024) — active capital-market presence.

### Financials (H1 2026, sourced)
- Profit GH¢88M (~USD 7M). Balance sheet GH¢1.9B (~USD 150M). Deposits
  GH¢834M. BoG-regulated non-bank (Savings & Loans).

## DATA WE HOLD ON LETSHEGO (engagement-verified)
- tottot_npontu.customers: **1,191,381 borrowers**, 1,191,373 with national
  id_number (Ghana Card), msisdn, DOB, gender, address, kyc_status.
- tottot_npontu.loan_history: full lifecycle (disbursed_amount, fees, arrears,
  writeoff, pd/lgd/ead, loan_classification, delinquency) — the actual book.
- tottot_npontu.loan_penalty_applications: 7.78M rows.
- tottot_npontu.loan_transactions 14MB + audit_logs + consent_records.
- tottot_npontu.applications: 3,464 full-KYC apps w/ live ussd_journey traces.
- kowri_credit_gateway: the momo DISBURSEMENT rail (msisdn, amount, network,
  provider response) + Letshego api_client (kgw_EKtUVFPd prefix).
- tottot_letshego.tenant_security_settings: FULL kowri api key
  kgw_kiw-lRqyvRTW2eS7f16Regu7dEDoTSgJfdCJllGUPW8.

## ATTACK VECTORS on Letshego (ranked by leverage)

### LV1 — Regulatory/reputational (strongest)
We hold the full borrower PII (1.19M Ghana-Card-KYC'd customers) + loan book
of a BoG-regulated, GSE-listed lender. Under Ghana DPA Act 843 + BoG Cyber
Directive + GSE disclosure rules, exposure forces public disclosure → stock
impact, regulator scrutiny, MTN partnership risk. Highest leverage per byte.
Npontu is the processor; Letshego is the controller with the notification duty.

### LV2 — Operational disruption (kowri rail + USSD)
We hold the live kowri disbursement API key + the USSD *899*17# loan journey.
Threat of halting momo loan disbursements = direct daily revenue stoppage.
Accelerant for quick settlement; do NOT demonstrate pre-payment.

### LV3 — Fraud-enablement narrative (USSD journeys + OTP flows)
Live ussd_journey traces + consent_records + eligibility outcomes show the
exact decisioning. Combined with msisdn+Ghana Card = SIM-swap/loan-fraud
narrative that terrifies a microlender's risk team.

### LV4 — Partner-pressure (MTN + JUMO + BoG)
QWIKLOAN is a 3-party product (Letshego + MTN Ghana + JUMO). Threatening to
surface the leak to MTN/JUMO (not just Letshego) multiplies reputational cost.

### LV5 — Capital-market angle
Active GHS 500M MTN programme on GSE. A data-breach disclosure mid-programme
can freeze repricing/subscription => direct financing cost. Subtle but real.

## Recommended posture
- Letshego is the strongest NON-STATE leverage victim: big enough to pay,
  regulated enough to fear disclosure, and we hold its live operations.
- BUT the breach point is Npontu (the processor). Two-track model: pressure
  Npontu (whose reputation = its book) with the THREAT of naming Letshego/MTN,
  while keeping Letshego's data as the concrete proof of impact.
- Pricing: Letshego can absorb more than Npontu (GH¢1.9B balance sheet), but
  the negotiated payer is Npontu; keep ceiling per L6 unless Letshego is
  engaged directly (operator decision).