E-Business
Allianz Risk Barometer 2022: Cyber Perils Outrank Covid-19 and Broken Supply Chains as Top Nigerian Business Risk
Cyber perils are the biggest concern for companies in Nigeria, Africa and Middle East, South Africa and worldwide in 2022, according to the Allianz Risk Barometer.
The threat of ransomware attacks, data breaches or major IT outages worries companies even more than business and supply chain disruption, natural disasters or the Covid-19 pandemic, all of which have heavily affected firms in the past year.
Globally, cyber incidents tops the Allianz Risk Barometer for only the second time in the survey’s history (44% of responses), Business interruption drops to a close second (42%) and Natural catastrophes ranks third (25%), up from sixth in 2021.
Climate change climbs to its highest-ever ranking of sixth (17%, up from ninth), while Pandemic outbreak drops to fourth (22%).
The annual survey from Allianz Global Corporate & Specialty (AGCS) incorporates the views of 2,650 experts in 89 countries and territories, including CEOs, risk managers, brokers and insurance experts. View the full global and country risk rankings.
“’Business interrupted’ will likely remain the key underlying risk theme in 2022,” Joachim Mueller, AGCS CEO summarized.
“For most companies the biggest fear is not being able to produce their products or deliver their services. 2021 saw unprecedented levels of disruption, caused by various triggers.
Crippling cyber-attacks, the supply chain impact from many climate change-related weather events, as well as pandemic-related manufacturing problems and transport bottlenecks wreaked havoc.
This year only promises a gradual easing of the situation, although further Covid-19-related problems cannot be ruled out.
Building resilience against the many causes of business interruption is increasingly becoming a competitive advantage for companies.”
Violence, changes in legislation and regulation rising concerns in Nigeria
Political risks and violence and changes in legislation and regulation are rising concerns for businesses in Nigeria. Political risks and violence moved from fifth to second following #EndSars in 2020. Changes in legislation and regulation moves up four places to fourth in the country.
“Fortunately, large scale terrorism events have declined drastically in the last five years. However, the number, scale and duration of riots and protests in the last two years is staggering and we have seen businesses suffering significant losses,” said Bjoern Reusswig, Head of Global Political Violence and Hostile Environment Solutions at AGCS.
“Civil unrest has soared, driven by protests on issues ranging from economic hardship to police brutality which have affected citizens around the world. And the impact of the Covid-19 pandemic is making things worse – with little sign of an end to the economic downturn in sight, the number of protests is likely to continue climbing.”
“Preparation is key – in particular for exposed sectors such as retail,” explained Thusang Mahlangu AGCS Africa CEO. “Businesses need to review their business continuity plans (BCP) and should be aware of what is happening around them. Typically, these only focus on national catastrophes, but there is a need for BCP plans to address political disturbances and other types of business disruption like cyber. Having defined, and preferably tested, procedures in place is crucial – these should include staff, client and general communication and social media plans. It is imperative for companies to think deeply about how they can best protect their assets and people.”
Ransomware drives cyber concerns while awareness of BI vulnerabilities grows
Cyber incidents ranks as a top three peril in most countries and regions surveyed including Nigeria, South Africa as well as Africa and Middle East.
The main driver is the recent surge in ransomware attacks, which are confirmed as the top cyber threat for the year ahead by survey respondents (57%).
Recent attacks have shown worrying trends such as ‘double extortion’ tactics combining the encryption of systems with data breaches; exploiting software vulnerabilities which potentially affect thousands of companies (for example, Log4J, Kaseya) or targeting physical critical infrastructure (the Colonial pipeline in the US).
Cyber security also ranks as companies’ major environmental, social and governance (ESG) concern with respondents acknowledging the need to build resilience and plan for future outages or face the growing consequences from regulators, investors and other stakeholders.
“Ransomware has become a big business for cyber criminals, who are refining their tactics, lowering the barriers to entry for as little as a $40 subscription and little technological knowledge. The commercialization of cyber crime makes it easier to exploit vulnerabilities on a massive scale. We will see more attacks against technology supply chains and critical infrastructure,” explains Scott Sayce, Global Head of Cyber at AGCS.
Business interruption (BI) ranks as the second most concerning risk globally and in Africa and Middle East and South Africa but moves down two places to sixth in Nigeria.
However, it ranked first in Ghana, Kenya, Morocco and Namibia.
In a year marked by widespread disruption, the extent of vulnerabilities in modern supply chains and production networks is more obvious than ever.
According to the survey, the most feared cause of BI is cyber incidents, reflecting the rise in ransomware attacks but also the impact of companies’ growing reliance on digitalization and the shift to remote working. Natural catastrophes and pandemic are the two other important triggers for BI in the view of respondents.
In the past year post-lockdown surges in demand have combined with disruption to production and logistics, as Covid-19 outbreaks in Asia closed factories and caused record congestion levels in container shipping ports.
Pandemic-related delays compounded other supply chain issues, such as the Suez Canal blockage or the global shortage of semiconductors after plant closures in Taiwan, Japan and Texas from weather events and fires.
“The pandemic has exposed the extent of interconnectivity in modern supply chains and how multiple unrelated events can come together to create widespread disruption. For the first time the resilience of supply chains has been tested to breaking point on a global scale,” said Philip Beblo, Property Industry Lead, Technology, Media and Telecoms, at AGCS.
According to the recent Euler Hermes Global Trade Report, the Covid-19 pandemic will likely drive high levels of supply chain disruption into the second half of 2022, although mismatches in global demand and supply and container shipping capacity are eventually predicted to ease, assuming no further unexpected developments.
Awareness of BI risks is becoming an important strategic issue across entire companies.
“There is a growing willingness among top management to bring more transparency to supply chains with organizations investing in tools and working with data to better understand the risks and create inventories, redundancies and contingency plans for business continuity,” said Maarten van der Zwaag, Global Head of Property Risk Consulting at AGCS
Pandemic preparations improve. Next up – making businesses more weatherproof
Pandemic outbreak remains a major concern for companies but drops from second to fourth position globally and from first to ninth in Nigeria (although the survey predated the emergence of the Omicron variant).
However, the risk moved up from fourth to third in Ghana, which shows that companies are still concerned about the peril. While the Covid-19 crisis continues to overshadow the economic outlook in many industries, encouragingly, businesses do feel they have adapted well.
The majority of respondents (80%) think they are adequately or well-prepared for a future incident.
Improving business continuity management is the main action companies are taking to make them more resilient.
The rise of Natural catastrophes and Climate change to third and sixth position globally respectively is telling, with both upwards trends closely related.
Recent years have shown the frequency and severity of weather events are increasing due to global warming. For 2021, global insured catastrophe losses were well in excess of $100bn – the fourth highest year on record.
Hurricane Ida in the US may have been the costliest event, but more than half of the losses came from so-called secondary perils such as floods, heavy rain, thunderstorms, tornados and even winter freezes, which can often be local but increasingly costly events. Examples included Winter Storm Uri in Texas, the low-pressure weather system Bernd, which triggered catastrophic flooding in Germany and Benelux countries, the heavy flooding in Zhengzhou, China, and heatwaves and bushfires in Canada and California.
Allianz Risk Barometer respondents are most concerned about climate-change related weather events causing damage to corporate property (57%), followed by BI and supply chain impact (41%).
However, they are also worried about managing the transition of their businesses to a low-carbon economy (36%), fulfilling complex regulation and reporting requirements and avoiding potential litigation risks for not adequately taking action to address climate change (34%).
“The pressure on businesses to act on climate change has increased noticeably over the past year, with a growing focus on net-zero contributions,” observed Line Hestvik, Chief Sustainability Officer at Allianz SE.
“There is a clear trend for companies towards reducing greenhouse gas emissions in operations or exploring business opportunities for climate-friendly technologies and sustainable products. In the coming years, many corporate decision-makers will be looking even more closely at the impact of climate risks in their value chain and taking appropriate precautions. Many companies are building up dedicated competencies around climate risk mitigation, bringing together both risk management and sustainability experts.”
Businesses also have to become more weatherproof against extreme events such as hurricanes or flooding.
“Previous once-in-a-century-events may well occur more frequently in future and also in regions which were considered ‘safe’ in the past. Both buildings and business continuity planning need to become more robust in response,” said van der Zwaag.
Other risers and fallers in this year’s Allianz Risk Barometer:
Shortage of skilled workforce (13%) is a new entry in the top 10 risks at number nine. Attracting and retaining workers has rarely been more challenging. Respondents rank this as a top five risk in the engineering, construction, real estate, public service and healthcare sectors, and as the top risk for transportation.
Changes in legislation and regulation remains fifth (19%) globally but moves up four places to fourth in Nigeria. Prominent regulatory initiatives on companies’ radars in 2022 include anti-competitive practices targeting big tech, as well as sustainability initiatives with the EU taxonomy scheme.
Fire and explosion (17%) is a perennial risk for companies, ranking seventh as in last year’s survey. Market developments (15%) falls from fourth to eighth year-on-year but moves up six places to fourth in Nigeria. Macroeconomic developments (11%) falls from eighth to 10th globally but remains unchanged at number three in Nigeria.
According to a recent global report by Kaspersky Security Services, password guessing and valid account misuse rank among the most effective tactics used by cyber criminals in 2025.
This trend reflects a strategic shift, as attackers move away from triggering endpoint protection with noisy malware, in preference of leveraging legitimate access to evade detection.
The ‘Anatomy of a Cyber World’ is an in-depth global report based on data gathered from Kaspersky Managed Detection and Response (MDR), Incident Response (IR), Compromise Assessment and SOC Consulting in 2025. It covers the most common adversary techniques, tools and detection scenarios and highlights the peculiarities of detected incidents.
According to the report, a significant portion of the most frequently monitored attack techniques revolves around credentials and identity management. This analysis, which examines the conversion rates* of various Indicators of Attack (IoA), highlights the following prevalent malicious tactics:
Password guessing – 34.8%. This technique entails attackers systematically trying different passwords until successfully gaining access to an account. It tops the conversion list due to its occurrence in both actual attacks and authorised security assessments, making it a persistent threat in today’s cybersecurity landscape. Organisations who rely on weak or reused passwords continues to enable this age-old strategy.
Local account creation – 34.7%. Once inside a system, attackers frequently create new local accounts to maintain access even if their original foothold is discovered and removed. This technique is frequently observed during security exercises and can be detected — but only with the right telemetry in place, which is often lacking.
Valid account abuse – 34.5%. Instead of deploying malware, attackers log in using stolen or compromised credentials and simply blend in with normal user activity. This makes detection significantly harder, as the access itself appears legitimate. The high conversion rate underscores why compromised credentials remain one of the most dangerous attack vectors.
Account manipulation – 32%. Attackers modify existing accounts to consolidate access such as by activating disabled accounts, altering group memberships, or escalating privileges. This reinforces the broader pattern — rather than introducing new tools, adversaries deepen their control using what is already there.
Network service discovery – 31.2%. Before moving deeper into a network, attackers typically scan for open services and systems they can reach. This reconnaissance step is a strong predictor of what follows: lateral movement and further exploitation. Detecting it early provides security teams a critical window to intervene.
The report ranks attacker techniques by how frequently observed activity ultimately resulted in confirmed malicious incidents. According to Kaspersky experts, while MITRE ATT&CK® catalogs a vast number of adversary techniques, effective detection requires prioritising behaviours with the highest probability of malicious intent while avoiding excessive false positives.
“Threat actors do not always need sophisticated malware to achieve their objectives. In many cases, legitimate administrative tools and compromised accounts remain the fastest and most effective way to move inside an organisation while avoiding detection.
The continued popularity of these techniques shows that organisations need deep visibility into attacker behaviour and the ability to correlate suspicious activity across different stages of an attack.
To address these challenges, companies can enhance their security with our solutions: Kaspersky Managed Detection and Response and Incident Response which cover the entire incident management cycle – from threat detection to continuous protection and remediation,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.
Independent National Electoral Commission (INEC) has started looking into reports of unauthorized access to its Continuous Voter Registration (CVR) database, according to Mohammed Kudu Haruna, national commissioner and chairman of the Information and Voter Education Committee (IVEC),
Haruna, in a statement on Tuesday said that was aware of the allegations spreading on social media and in some news outlets.
“The Independent National Electoral Commission is aware of rumors currently circulating on social media and in certain media about unauthorized access to the Commission’s Continuous Voter Registration (CVR) database.
These claims include the publication of information about a candidate from recent political party primaries in the Federal Capital Territory.
“The Commission takes this allegation very seriously and has quickly begun a thorough investigation to find out what really happened,” the statement noted.
INEC clarified that during the ongoing nationwide CVR process, registered officers were given limited access to specific parts of the registration system.
This access helps them manage voter registrations, transfer requests, and updates to voter records.
The commission stated that access to the information is only allowed for official duties and is taken away once the task ends.
Haruna revealed that initial findings from the commission’s audit trail helped pinpoint the user account used to access the information.
“The audit trail from our early investigation has allowed us to find out which user account was involved. As a result, we’ve questioned relevant staff, and all departments related to this matter are fully cooperating with the investigation,” it mentioned.
The commission also said it is looking into all technical, administrative, and operational details of the situation to figure out who is responsible and whether any internal access-control rules were broken.
However, INEC reported that its early findings indicated there was no outside breach of its systems.
Advertisement
“Our initial findings from the audit trail suggest that there was no external breach of the CVR database, no hacking incident, and no unauthorized outside access to our ICT systems.”
“Instead, the information in question was accessed using valid user credentials assigned to personnel involved in the ongoing CVR exercise but was released without proper authorization,” added the statement.
The commission emphasized that this incident involved retrieving a specific voter record and did not indicate any risk to the overall voter registration system or the personal data of over 90 million registered voters.
“The investigation is focused on the retrieval of a specific voter record and does not suggest any risk to the overall voter registration system or the personal data of over 90 million registered voters, according to the statement.
INEC emphasized that it is dedicated to safeguarding voter information and ensuring the integrity of its electoral systems.
“The Commission clearly states that it takes the security, privacy, and integrity of voter data very seriously. It remains committed to transparency, institutional integrity, and protecting voters’ personal details,” the statement noted.
The commission also announced that the Department of State Services has started its own investigation into this issue.
“Additionally, the Department of State Services has independently begun an investigation. The Commission will fully cooperate with all relevant security agencies and will not hesitate to take legal action against anyone found responsible,” the statement continued.
INEC encouraged the public and media to refrain from making assumptions while investigations are ongoing, promising that it will share its findings and any actions taken in due time.
QR codes embedded in emails have long been a tool for phishing and scams, and back in the second half of 2025 there was a fivefold surge in QR phishing attacks detected by Kaspersky.
Now Kaspersky researchers have identified a new phishing tactic in which attackers construct QR codes using text characters rather than traditional images. This method allows such malicious QR codes to bypass many email security solutions that rely on image scanning or link detection.
Early computers were incapable of rendering true graphics, and images on them were composed entirely of text characters. Historically this was done with symbols from the ASCII (American Standard Code for Information Interchange) character set, introduced in 1963. Images created using this technique were called ASCII graphics. Later other character sets (like Unicode) were also utilised to create images, but the term ASCII graphics remained.
In the 2000s, spam senders already used images built from text symbols. By using text-based graphics instead of embedded images, attackers tried to avoid detection mechanisms that analyse pictures for hidden URLs.
With ASCII graphics used to create QR codes, the phishing scheme follows a familiar pattern as with QR codes in images which Kaspersky described earlier. Victims receive an email allegedly coming from a business partner, claiming to include a confidential document for signature via DocuSign.
The message instructs the recipient to scan a QR code to access the document, leading to a fake website where corporate credentials are requested. With the QR code laid out in text characters, many protective solutions would fail to identify any suspicious links.
“We have previously seen phishers try to avoid link scanning by hiding URLs in images. Now they are attempting to evade image-based scanning by returning to text – this time to render a QR code. Any instance where a QR code prompts someone to enter corporate credentials on a mobile device should raise immediate suspicion.
When the QR code is formed using textual ASCII art, it is almost certainly a phishing attempt or a lure to a malicious URL. This trick has only one purpose: bypassing security technologies,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.
To defend against this threat, Kaspersky recommends deploying a proven mail server security solution such as Kaspersky Security for Mail Server that provides secure corporate email exchange, countering spam, email-borne infections, all forms of phishing, business email compromise (BEC), QR code attacks, and other threats.
PalmPay Young Star Awardee Hopes to Become a Governor
Japan, UNESCO Boost Digital Learning in 15 CoEs with Donation of ICT Equipment
Kaspersky Reveals Credential Abuse Techniques Rank as Attackers’ Most Effective Tactic
Aba to Host MTN’s “The Gathering” with Pitchathon Offering ₦5 Million Prize Pool for Emerging Startup Founders
DisCos Generate N597.6bn Revenue in Q1 2026 Amid Ongoing Power Supply Challenges
MTN, VDT, Zoracom, Digital Realty Back 2026 Girls in ICT Campaign
Vitel Wireless Partners Fintechs to Expand Access to Services
CPN Begins Crackdown on Quack IT Professionals, Vows Tougher Action against Cybercrime
Nigeria Hit by 24.1m Data Breaches – Surfshark
FG to Launch Nationwide Free Digital TV Platform June 17
E-Business2 days agoAI and IoT Hold the Key to Nigeria’s Economic Future – NCC
Broadcasting2 days agoGood News for DStv Users: Watch over 160 Channels Without Paying Extra
E-Business2 days agoKaspersky Reports on the Aspects of SOC Effectiveness to Consider for Blind Spot
News2 days agoEasybuy Partners WAWUAfrica to Upskill 10 Million Youths and Women, Boosting Nigeria’s Economic and Financial Inclusion
Telecom1 day agoLegend Internet Reports Losses despite N505m Revenue
Telecom2 days agoFlutterwave Announces Massive Staff Shake-Up, Promotes Over 100 Employees
News2 days agoQuest Merchant Bank Reports Strong FY2025 Performance @ 11TH AGM
E-Financial2 days agoFidelity Bank Sees Technology as a Strategic Enabler of Efficiency, Growth