CSA fines ORC, Purpleline Solutions GH¢360,000 over cybersecurity breaches

• The CSA fined the ORC GH¢240,000 for engaging an unlicensed cybersecurity provider.

• Purpleline Solutions Limited Company was fined GH¢120,000 for providing cybersecurity services without a licence.

• The CSA warned institutions and service providers that cybersecurity licensing is a legal requirement.

The ORC has been fined GH¢240,000 for engaging a cybersecurity service provider that was not licensed by the CSA, while Purpleline Solutions Limited Company was fined GH¢120,000 for providing cybersecurity services without the required licence.

The sanctions follow the CSA’s determination that the ORC failed to comply with lawful directives requiring institutions designated as Critical Information Infrastructure (CII) to engage appropriately licensed Cybersecurity Service Providers (CSPs).

Also Read: New scam alert: Fake restaurant and food vendor scams surge as victims lose nearly GHC300k in 6 months

On June 15, 2026, the CSA directed the ORC to engage Tier 1 licensed CSPs to strengthen the security and resilience of its Critical Information Infrastructure.

The ORC was also required to provide information on its cybersecurity service providers, the Terms of Reference for its proposed Security Operations Centre (SOC) and relevant Public Procurement Authority (PPA) approvals.

However, the CSA said the ORC proceeded to engage Purpleline Solutions Limited Company despite the directives.

Also Read: Ghana arrests Nigerian man wanted by FBI, INTERPOL in major international cyber fraud case

The Authority determined that the ORC had failed to comply with two separate directives, constituting a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038).

Under Section 92(2) of the Act, the ORC was fined 10,000 penalty units for each instance of non-compliance, bringing its total penalty to GH¢240,000. The Authority has also directed the ORC to comply with the outstanding directives within one month of receiving the sanction letter.

The CSA separately found that Purpleline Solutions Limited Company provided cybersecurity services without holding the required licence.

Also Read: CSA warns Ghanaian Universities after University of Nottingham cyberattack exposes data of 450,000 students and alumni

The company applied for a cybersecurity service provider licence on July 15, 2026, but the CSA noted that the application came after the company had already been engaged by the ORC.

The Authority stressed that applying for a licence does not amount to being licensed and does not authorise a company to provide regulated cybersecurity services.

Purpleline Solutions Limited Company has therefore been fined 10,000 penalty units, equivalent to GH¢120,000.

Also Read: Hackers are using FortiBleed to break into business networks - CSA explains the threat

The CSA warned institutions and cybersecurity companies against bypassing the licensing requirements.

“The CSA wishes to make it unequivocally clear that the engagement or provision of cybersecurity services without the requisite license will not be tolerated,” the Authority said.

It added: “Institutions must not engage unlicensed Cybersecurity Service Providers, and companies must not provide regulated cybersecurity services unless they have first obtained the appropriate license from the CSA.”

The Authority also cautioned organisations against assuming that a pending application allows a provider to begin operations.

Also Read: Stop threatening to ‘snatch people’s husbands’ – CSA warns recent SHS graduates

“An application for a license is not the same as holding a license and does not authorise an entity to commence regulated cybersecurity operations,” it said.

The CSA has consequently urged CII institutions, public-sector organisations and other entities covered by the Cybersecurity Act to verify the licensing status and appropriate licence tier of cybersecurity providers before awarding contracts or allowing them to commence work.

“Cybersecurity licensing is a legal requirement, not an administrative formality,” the Authority said.

Also Read: National Community Media Cyber Capability Building Project Launch set for 3rd August 2026

The CSA added that it would continue to monitor compliance and take enforcement action against institutions that engage unlicensed providers and companies that provide cybersecurity services without the requisite licence.