E-Business
Many Africans Still Believe Cybercrime ‘won’t Affect them’ – Report
The digital landscape is overflowing with an ever-evolving array of solutions and services created to make lives easier, offices smoother and engagements richer.
Smartphones, applications, social media, artificial intelligence (AI) platforms and multiple other tools have all become part and parcel of daily life on the African continent, transforming how people connect, collaborate and engage.
Unfortunately, they have also opened up cyber windows that let in the attacks and the threats that compromise organisations and individuals.
For Anna Collard, SVP Content Strategy & Evangelist at KnowBe4 Africa, it has become critical for organisations to invest in training and awareness programmes that help them to identify criminal tactics and mitigate risk.
“We undertook a poll to assess cybersecurity awareness in Africa and discovered that some of the key issues facing organisations right now were awareness and understanding,” she explains. “Many people still feel safe online and believe that cybercrime will not affect them personally. Others expect their work to take care of their cyber safety or do not know how to mitigate the threats themselves.”
The KnowBe4 Cybersecurity in Africa survey polled 800 employees across multiple sectors in Mauritius, Botswana, Egypt and Ghana to assess their cybersecurity awareness.
The survey focused on their levels of connectivity, the digital devices and platforms used, their perceptions of cybersecurity, the ways in which they work and their understanding of the threats.
Of those surveyed, 97% use a smart phone, 74% use a laptop, 47% have a smart TV, 31% use a tablet, 17% have a gaming console, 8% use a feature phone and less than 1% had none of these devices.
When asked what applications they use for work, the most prevalent was WhatsApp (89%), followed by email (80%), Facebook (59%), Telegram (46%), Instagram (45%), Twitter (42%), Zoom (42%), LinkedIn (36%), Microsoft Teams (18%), Snapchat (18%), Slack (5%), WeChat (4%), Signal (4%) or other tools (1%).
On the personal front, the picture remains largely unchanged with Facebook ranking second (78%), followed by Instagram (57%), email (46%), Telegram (40%), Twitter (39%), Snapchat (25%), LinkedIn (14%), Zoom (11%), Signal (3%), Microsoft Teams (2%) and other tools (1%).
“WhatsApp is the most used app across both personal (98%) and business use cases,” says Collard. “While email remains the most popular form of business communication on the continent, it is still immensely popular for personal use. Both platforms are high-risk for cyber threats such as phishing, ransomware and fraud, so these should be a priority for organisations looking to drive awareness and training.”
Connectivity is of course a key concern, as it often introduces vulnerabilities into both professional and personal networks and devices. The survey found that 71% access the internet through their mobile networks, overlapping with the 71% who access the internet through home Wi-Fi, and 36% who go online through work/office networks, while 12% access the internet at internet cafes, and 15% use free Wi-Fi at public places.
“The question is – do people understand the risks associated with accessing the internet in public places and are they putting the right security protocols in place?” asks Collard. “Often, people do not even know that they can be hacked while they access free Wi-Fi, or that they can have critical information, like passwords, stolen while they are online.”
This concern is reflected in the research around cybercrime awareness. On a scale of one to five, most said that they were concerned with cybercrime, with 29% saying they were ‘very concerned’ and 38% saying they were ‘concerned’.
However, 19% said that they were ‘somewhat concerned’ but that they did not understand the threats or how to mitigate them while 7% said that they did not believe it affected them personally because their work took care of it and 7% felt safe and ‘not at all concerned’.
“The problem is – everyone should be concerned about cybercrime,” says Collard. “All it takes is for one person to introduce a virus to a system or open up a doorway or lose their passwords, and the entire organisation is put at risk. Training has never been more important, especially when there is a clear trend around people feeling like they do not know enough about cybercrime to protect themselves or feel like they do not understand what they need to do to stay informed about the risks.”
This is reflected in the biggest concerns raised by those who were worried about cybercrime, with respondents citing online fraud (51%), identity theft (24%), children and family (14%), lack of understanding (10%) and other concerns (1%) as their primary worries. While over half said that they had received cybersecurity training from their employers, only 21% agreed that the training was adequate, while 10% felt it was not adequate at all.
And it is worth noting that many people still were not entirely sure what their roles and responsibilities were around information security (11%) and 45% said that they ‘somewhat agree’ that they could recognise a security incident. Only 34% of people said they felt ‘very confident’ that they could recognise a security incident if they saw one.
Most respondents are hesitant to give away personal information, with 29% saying they tended not to share personal details such as their identity number, and 51% saying they would share this information only if there was a real need to do so, and they understood what it was being used for. 13% part with personal information if they cannot avoid it.
Worryingly, 7% are comfortable sharing personal information, with 4% saying they are likely to do so if they can get something in return – such as a discount, and 3% saying they share personal information all the time.
“Then, we look at issues like cyber hygiene and discover that only 43% of respondents could identify what ransomware was, and only 61% could identify a strong password,” says Collard. “A worrying 20% selected P@$$word!, 25% selected thisismysuperwonkyapp#1, 16% chose Summer#123 and 3% chose Grandma1959. 6% said none of these were strong passwords. Only the 62% who chose DSM@8043&! were correct.”
Digging deeper into how well people understand security, the survey asked people to define two-factor authentication, and 60% said it was ‘using my password plus something I own, such as a One Time Password generator’.
However, 20% said it was ‘Entering my password twice for extra security’, 8% said it was Captcha generators, 9% said it was using two different passwords and 4% said it was using a password manager.
Only 17% say none of the common cybercrime tactics have affected them. More than half (51%) said they had previously had a virus infection on their computer, 32% had lost money due to a scam or con artist, 26% had clicked on a phishing mail, 21% had been scammed from a phone call and 17% had forwarded a scam or hoax email.
When checking to determine whether an email is legitimate, 55% said they only trusted emails from people they knew, 54% do not click on links or open attachments they were not expecting, and 27% check for bad grammar or spelling as a sign the mail is not legitimate. 31% Google the sender or topic to see if it is a scam, 23% hover over links to see their origin, and 11% do all the listed checks.
Add to this the risks of working from home – 32% said they had moved to work from home and among the 20% who were affected by cybercrime while working from home, a multitude of scams and cybercrimes occurred. These scams ranged from being tricked in crypto investment schemes and identity theft, through to accidentally downloading viruses and being hacked.
“The entire landscape is a challenge and the only way to thrive within this complexity is to arm your people with the tools and understanding they need to protect themselves,” concludes Collard.
“Training is the only way to ensure that all the protections and security investments made by the business are fully realised by those who use them. If people understand the threats, their role in mitigating the threats, and what to do to protect against them, they are empowered and more able to overcome the challenging landscape that lies ahead.”
Nigeria’s data protection industry has grown into a N16.3 billion ecosystem within three years of formal regulation, according to the Nigeria Data Protection Commission (NDPC).
Olufemi Ibitayo, head of Finance Management and Control, NDPC, announced the milestone at the Regional Data Governance Exchange in Nairobi, Kenya, where he represented Dr Vincent Olatunji, national commissioner and chief executive officer, NDPC.
Presenting Nigeria’s progress, Ibitayo said the country’s strong regulatory framework and the establishment of an independent data protection authority have strengthened confidence in the digital economy and enhanced Nigeria’s reputation as a destination for foreign investment.
The Regional Data Governance Exchange, organised by the Data Governance in Africa Initiative and hosted by the Office of the Data Protection Commissioner in Nairobi, brought together African data protection authorities to strengthen institutional capacity, deepen collaboration and promote peer learning on data governance. Photo: NDPC
He said the Commission’s “Compliance First, Not Punishment” approach encourages organisations to meet their obligations through dialogue and voluntary compliance, while ensuring effective regulatory oversight.
Ibitayo added that the NDPC is developing regulatory technology solutions, a regulatory sandbox and a data privacy innovation laboratory to further strengthen Nigeria’s data governance ecosystem and support future growth.
United Nations Commission on International Trade Law (UNCITRAL)
The ongoing UNCITRAL session has brought together delegates from Nigeria, Australia, China, Ghana, France, the United States and other member states to develop harmonised legal frameworks aimed at facilitating secure, trusted and efficient cross-border digital commerce. Photo: NDPC
Meanwhile, Olatunji reaffirmed Nigeria’s commitment to global data governance during a meeting with Nigeria’s Permanent Representative to the United Nations, Ambassador Jimoh Ibrahim.
He made the remark on the sidelines of the ongoing United Nations Commission on International Trade Law (UNCITRAL), where Nigeria is participating alongside delegates from several member states to advance harmonised legal frameworks for secure and trusted cross-border digital commerce.
The NDPC boss highlighted the Commission’s achievements since its establishment, noting that strategic institutional reforms have positioned Nigeria as a leading voice in the global data protection ecosystem.
He said the country’s data protection framework has continued to earn international recognition, adding that the Commission remains committed to promoting trusted data governance as a driver of digital transformation, economic growth, innovation and sustainable development in line with the Renewed Hope Agenda of President Bola Ahmed Tinubu.
During the meeting, Ambassador Ibrahim commended the Commission’s progress since the enactment of the Nigeria Data Protection Act 2023 and called for the establishment of a comprehensive national data bank to support evidence-based policymaking, research and national development.
National Identity Management Commission (NIMC) has said thet more than 136 million Nigerians and legal residents have been enrolled in the National Identity Database (NIDB).
In a statement on Tuesday, Kayode Adegoke, head of corporate communications, NIMC, said Abisoye Coker-Odusote, chief executive officer (CEO) of the commission, announced the milestone during a courtesy visit to the ministry of budget and economic planning.
In April 2025, NIMC said over 117.36 million Nigerians had been enrolled as of February 28, 2025.
The visit was part of the commission’s ongoing stakeholder engagements with ministries, departments and agencies (MDAs) on the implementation of the NIMC Act 2026.
Presenting the new Act, Coker-Odusote said the legislation repeals and replaces the 2007 NIMC Act, modernising Nigeria’s digital identity ecosystem by positioning the national identification number (NIN) as the country’s foundational identity under the “one person, one identity” policy.
She said the law also establishes NIMC as the root certificate authority for the national digital infrastructure and introduces stronger data protection and cybersecurity measures, as well as digital credentials.
“The Federal Government remains committed to enrolling and issuing NINs to all Nigerians and legal residents within the shortest possible time,” Coker-Odusote said.
She added that NIMC is ready to collaborate with the ministry of budget and economic planning to leverage the NIN for economic planning and national development initiatives.
Speaking during the visit, Abubakar Atiku Bagudu, the minister of budget and economic planning, reaffirmed the federal government’s commitment to the implementation of the NIMC Act 2026.
Bagudu described the legislation as “a transformative milestone” that would strengthen Nigeria’s digital identity ecosystem and accelerate national planning and development.
He commended the NIMC director-general and the commission’s leadership for their efforts in securing the passage of the legislation, noting that it provides “a solid legal foundation for a trusted, secure, and inclusive national identity management system”.
The minister, however, said the true measure of the Act’s success would lie in its implementation and the benefits it delivers to Nigerians.
“The true measure of the Act’s success will lie in its effective implementation and the tangible benefits delivered to citizens,” he said.
Bagudu also called for stronger collaboration across the federal, state and local governments to build public confidence in the national identity system and eliminate the duplication of identity databases across government institutions.
He said the NIN should serve as Nigeria’s single, universally accepted identity standard, supporting efficient service delivery and good governance.
On June 26, President Bola Tinubu signed the NIMC Act 2026 into law, repealing the commission’s 2007 establishing Act.
At the time, Olubunmi Tunji-Ojo, minister of interior, said the legislation would strengthen Nigeria’s legal framework for digital identity management, cybersecurity and secure digital authentication, while reinforcing the NIN as the country’s foundational identity credential under the “one person, one identity” principle.
Plateau State Public Complaints Commission (PCC), an agency of the state established to investigate complaints of abuse of office, administrative injustice and other forms of official misconduct is allegedly collecting personal information from members of the public through its website with no privacy policy.
According to investigation by Foundation for Investigative Journalism (FIJ), PCC is falling short of a key transparency requirement under Nigeria’s data protection laws.
FIJ found on Tuesday that PCC collects personal information from members of the public through its website despite providing no privacy policy explaining how that information is collected, processed, stored or protected.
The commission serves as the state’s ombudsman, receiving complaints free of charge against public institutions and private organisations on issues including wrongful dismissal, victimisation and administrative negligence.
Yet, while its online complaint portal requests personal information such as names, phone numbers, email addresses, subject lines and complaint details, visitors are given no privacy notice explaining what becomes of that information after it is submitted.
The omission means visitors are not told why their information is being collected, how long it will be retained, the legal basis for processing it or the rights available to them as data subjects.
WHAT IS THE POSITION OF THE LAW?
The guidelines issued by the National Information Technology Development Agency (NITDA) are explicit: every government website is required to have a privacy policy.
Section 10.4 (i, ii) of the NITDA guidelines mandates all government websites to exercise diligence when collecting personal details or information about visitors on their websites.
The requirement is intended to ensure transparency and accountability in the handling of personal information, allowing visitors to understand why their data is collected, how it will be used and the safeguards in place to protect it.
Similarly, the Nigeria Data Protection Act (NDPA) 2023 requires data controllers to provide privacy notices to individuals before, or at the point of, collecting their personal information.
Such notices are expected to disclose, among other things, the purpose for collecting the data, the legal basis for processing it, the period for which it will be retained and the rights available to data subjects.
Section 27 of the NDPA states:
(1) Before a data controller collects personal data directly from a data subject, the data controller shall inform the data subject of the – (a) identity, residence or place of business of, and means of communication with the data controller and its representatives, where necessary;
(b) specific lawful basis of processing under section 25(1) or 30(1) of this Act, and the purposes of the processing for which the personal data are intended;
(c) recipients or categories of recipients of the personal data, if any;
(d) existence of the rights of the data subject under Part VI;
(e) retention period for the personal data;
(f) right to lodge a complaint with the Commission in accordance with section 46 (1) of this Act; and
(g) existence of automated decision-making, including profiling, the significance and envisaged consequences of such processing for the data subject, and the right to object to and challenge such processing.
Without a privacy policy, visitors have no way of knowing the commission’s data-handling practices or the safeguards, if any, in place to protect the personal information they submit through the website.
At press time, the Plateau State Public Complaints Commission’s website had no privacy policy.
CAC to Sanction Companies with Incomplete Business Letters From August 1
BVN Enrollments Hit 69.55m- NIBSS
CBN Warns against Rejection of N100 Banknotes
Data Protection Industry Hits N16.3Bn in 3 Years- NDPC
NCC Seeks Cost-Based Pricing Framework for Ducts
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Mobile Internet Gender Gap Widest in Africa – GSMA
Nigeria Launches FreeTV Nationwide
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
CredibleVoteNG Opens Free Access to all Polling Units in Nigeria after INEC Demanded N1.Bn for Register
News1 day agoNRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
General News2 days agoIHS Nigeria, FCT-HSES Concludes Clean Cooking Energy Campaign “Project Breathe Clean Air” in Abuja
E-Business2 days agoKaspersky Transforms Threat Intelligence Reporting into an Interactive Content Hub
News2 days agoMicrosoft to Lay Off 4,800 Workers
Telecom2 days agoAirtel Africa Cuts Diesel Dependence by 9.1m Litres
Telecom2 days agoA New Blueprint – How Strategic Collaboration is Rewriting the Narrative on Youth Drug Abuse
Broadcasting2 days agoNELFUND Investigates 34 Universities Over Students’ Missing Tuition Refunds
News2 days agoAccess Bank, Fifth Chukker and UNICEF Renew Commitment to Expanding Educational Opportunities for Nigeria’s Most Vulnerable Children