A series of recent cybersecurity incidents affecting financial institutions, government-linked platforms, and fintech operators is beginning to reveal a pattern that can no longer be ignored. What may have initially appeared as isolated breaches is now raising deeper concerns about a broader and possibly coordinated threat landscape targeting the country.

At the heart of this conversation is a critical shift in perspective. Cybersecurity incidents must no longer be viewed as problems belonging to individual organisations. They represent a national risk. The growing frequency and spread of these attacks suggest that no institution is immune, and more importantly, that those not yet affected cannot afford complacency. For organizations that have not experienced any disruption, this is not a moment for reassurance. The emerging pattern suggests it may only be a matter of time.

The growing concern follows a wave of alleged cyber incidents targeting organizations across banking, fintech, government, insurance, and education sectors, raising fears that sensitive data belonging to millions of users may be at risk.

At the centre of the unfolding situation are bank customers, fintech users, government workers, and students, whose personal and financial information could be exposed if the claims are substantiated. What initially appeared as isolated breaches is now being viewed as a potentially broader and more coordinated threat affecting Nigeria’s digital infrastructure.

Against this backdrop is a post by @TrendingEx on X (formerly Twitter), which claimed that more than 3TB of sensitive data linked to multiple Nigerian organizations had been published online. The post listed entities including Remita, Sterling Bank, Zenith Bank, the Oyo State Government, Leadway Assurance, GetBumpa, and Ahmadu Bello University, alongside more than 30 other companies.

Beyond these cases, the breadth of organizations named has raised deeper concerns about systemic exposure. The entities span financial services, public sector systems, insurance providers, fintech platforms, and academic institutions, suggesting that attackers may be probing shared weaknesses rather than targeting single organizations in isolation.

Cybersecurity incidents of this nature typically involve attackers exploiting technical vulnerabilities or misconfiguration to gain access, followed by the extraction of sensitive data. Such data is often used for extortion, fraud, or public leaks. In some cases, the scale of access may be overstated, but even limited breaches can have far-reaching consequences when systems are interconnected.

What makes the current situation particularly concerning is not just the incidents themselves, but their apparent timing and spread. The near-simultaneous emergence of cybersecurity concerns across banking, fintech, and public sector systems suggests a broader systemic vulnerability. From institutions such as Flutterwave to Fidelity Bank, past and recent incidents continue to illustrate that no segment of the ecosystem is insulated from risk.

Cybercriminal tactics in these scenarios often follow a familiar pattern. Attackers typically seek to gain initial access through technical vulnerabilities or misconfiguration. Once inside, they may attempt to extract sensitive data which is then used as leverage. In many cases, organizations are approached with demands, with the threat of public exposure if compliance is not met.

However, not all claims made by threat actors are accurate. In some instances, attackers exaggerate the scale of their access to increase pressure. A breach involving a limited number of records may be presented as a compromise affecting millions. This strategy is designed to create panic, attract attention, and force quicker responses from targeted organizations.

In response to rising cyber risks, the Central Bank of Nigeria has introduced a mandatory cybersecurity self-assessment for banks and financial institutions, signalling tighter regulatory scrutiny across the sector.

At the policy level, the Minister of Communications, Innovation and Digital Economy has also emphasized the importance of collaboration in strengthening national cyber resilience, highlighting the need for stronger coordination between government and the private sector.

Despite these developments, experts warn that the public narrative must be handled carefully. Focusing solely on individual organisations risks overlooking the broader issue of systemic vulnerability. More importantly, isolating affected institutions could discourage transparency and delay information sharing, both of which are critical in responding effectively to cyber threats.

The wider implication is that cybersecurity incidents can no longer be treated as isolated corporate challenges. As digital systems become increasingly interconnected, a breach in one organization can have ripple effects across multiple sectors, undermining trust in the broader digital economy.

For individuals, the risks are immediate and tangible. Data breaches can expose personal information, enabling identity theft, financial fraud, and targeted cyberattacks. This makes vigilance essential not just for institutions, but for everyday users who rely on digital platforms.

While the full extent of the alleged breaches remains unclear, the pattern of claims, their timing, and the range of organizations involved point to a critical moment for Nigeria’s cybersecurity landscape.

Whether these incidents are ultimately confirmed or not, they underscore a growing reality: in an interconnected digital environment, the security of one organization is closely tied to the security of all.

Gbolabo Awelewa, chief Business Officer, Esentry, said that industry-wide collaboration is critical. Cyberattacks targeting banks and payment platforms are becoming more coordinated and sophisticated, and no single organization can address them alone.

“Stronger collaboration between financial institutions, fintechs, regulators, and cybersecurity providers will enable faster threat intelligence sharing and a more unified response to emerging risks.

“At esentry, we see first-hand how proactive security measures make a significant difference. Organizations need continuous monitoring of their infrastructure, regular vulnerability assessments, stronger identity and access management, and real-time threat detection capabilities to identify and respond to attacks before they escalate.

“Beyond technology, institutions must also prioritize resilience; ensuring they can detect, respond to, and recover quickly from incidents.

“Ultimately, cybersecurity today is an ecosystem challenge, and organizations that combine strong security frameworks with industry collaboration will be better positioned to stay ahead of evolving threats,” he stated.

However, there is a growing concern that public discourse may be drifting in the wrong direction. Focusing on blame or singling out affected organisations risks undermining collective security. When institutions are publicly isolated, it may discourage transparency and delay critical information sharing, both of which are essential in responding to cyber threats effectively.

More importantly, a fragmented approach can embolden attackers. When threat actors perceive a lack of unity, they are more likely to expand their activities, targeting additional organizations and exploiting systemic weaknesses. This makes it imperative for stakeholders to adopt a unified stance.

The current moment calls for a shift from reaction to coordination. Regulators, private sector players, and cybersecurity professionals must work together to build a shared defence framework. This includes timely information sharing, joint incident response strategies, and consistent enforcement of security standards across the ecosystem.

For the public, the implications are equally significant. Data breaches are no longer abstract technical events. They carry real-world risks, including identity theft, financial fraud, and targeted social engineering attacks. As such, awareness and vigilance must extend beyond institutions to individual users who interact with digital platforms daily.

Ultimately, the message is clear. Nigeria’s cybersecurity challenges cannot be addressed in isolation. Whether the threat originates from within or outside the country, its impact is collective. Every breach, regardless of where it occurs, has the potential to weaken trust in the broader digital economy.

Custodian Investment Plc shelled out N419.13 million in penalties to the Central Bank of Nigeria (CBN) and other regulators for breaches in the 2025 financial year, up sharply from N19.17 million in 2024.

Custodian Investment

The company revealed this in its audited financial statements filed on the Nigerian Exchange (NGX).

CBN accounted for N391 million of the penalties, including a hefty N240 million fine for violating intraday liquidity facility (ILF) rules on a CBN bond trade.

The ILF allows banks to settle same-day transactions with repayment due by close of business.

Custodian also paid N76 million for Customer Due Diligence lapses and N75 million for ignoring internal audit fixes on a misclassified high-risk customer.

Smaller fines piled on, but the firm recovered the full N240 million ILF penalty from Sterling Bank Plc, the counterparty.

Despite the hit, profit before tax climbed to N77.35 billion, with fines under 1% of that figure.

After recovery, the net cost shrank below 1% of management expenses and profit.

Net income hit N91.32 billion, easily covering N21.1 billion in expenses including fines, fueled by surging investment income, fair value gains, interest growth and an insurance unit turnaround from loss to profit.

Offset Communications Advisory Ltd has dragged Qore Technologies Ltd before a Federal High Court in Lagos, demanding the sum of N50 million as damages for the alleged infringement of its copyright.

Pic credit….https://copyrightalliance.org

Offset, in the suit marked: FHC/L/CS/1994/2025, is claiming that Qore used content from a proposal it submitted in December 2022, without formal engagement, attribution, or a licensing agreement.

“The Defendant’s execution of the content of the proposal submitted to it by the Plaintiff without any formal engagement, attribution or a licensing arrangement… amounts to an infringement of the Plaintiff’s copyright,” Offset stated in its writ of summon.

The suit filed on September 29, 2025, by Jimoh Bamigbola and Omobolaji Idris, on behalf of the plaintiff has Qore as sole defendant.

Plaintiff, a Lagos-based communications firm, in its statement of claim said it a had previously worked with Qore on Public Relations (PR) projects and was later asked to prepare a communications strategy for the company, adding that the said proposal contained ideas on employee engagement, branding, and stakeholder management.

Offset however, alleged that Qore implemented elements of the proposal, including internal communication initiatives and branding concepts, without payment or agreement.

“The Defendant executed and integrated the propositions into its Public Relations and Communication Strategy without any formal engagement… with the Plaintiff,” the statement of claim read.

The plaintiff said it discovered the alleged infringement in April 2025 and subsequently notified the defendant, but efforts to resolve the dispute failed.

It is seeking, among other reliefs, a declaration that the defendant’s actions amount to copyright infringement, N50 million in general damages, N5 million in litigation costs, 29 percent post-judgment interest, and “an order of perpetual injunction, restraining the Defendant… from further infringing on the Plaintiff’s copyright.”

Qore Technologies, however, denied the allegations in its statement of defence, arguing that the plaintiff was only engaged for limited Public Relations support services on a project basis and was paid for those services.

“The Plaintiff merely provided routine and secondary Public Relations support services… for which the Plaintiff was remunerated,” the defendant stated.

Qore further argued that the ideas referenced by the plaintiff are not protected under copyright law.

“The alleged ‘ideas’… consist of generic corporate communication practices widely used by companies… and cannot constitute original copyrightable works under Nigerian law,” it said.

The company also maintained that no binding agreement existed regarding the proposal and that its branding and communication strategies were developed internally and by its consultants.

In addition, Qore challenged the competence of the suit, stating that “the Statement of Claim discloses no reasonable cause of action” and that the court lacks jurisdiction to entertain the matter.

The defendant also filed a counterclaim, seeking N6.35 million as reimbursement for legal fees incurred in defending the suit, as well as N2 million in costs.

At the hearing on March 23, 2026, counsel to the parties identified their processes, and the court adjourned the matter to June 22, 2026, for further proceedings.

The case is expected to test the boundaries of copyright protection in Nigeria’s Communications and Public Relations industry, particularly regarding the ownership of proposals and business ideas.