Decision to cancel the $32.8 million fine previously imposed on Meta for alleged data privacy violations was taken as far back as October 30, 2025.

The development has raised concerns over the country’s approach to data protection enforcement and regulatory transparency.

This followed a confidential, out-of-court settlement singed by Nigerian Data Protection Commission (NDPC) with Meta, effectively waiving the fine imposed earlier that year.

This deal, sanctioned by a Federal High Court, resolved disputes over behavioural advertising and user data transfers without Meta paying the penalty.

Recall that the NDPC claimed that it launched investigation in September 2023 that examined Meta’s handling of personal data from more than 60 million Nigerian users.

The NDPC had accused Meta of several breaches, including the absence of explicit consent for behavioural advertising, unauthorised cross-border data transfers, the collection of data from non-users, and the deployment of algorithms that could expose users to financial and health risks.

At the time, the regulator described the penalty as part of efforts to strengthen digital rights protections in Africa’s most populous country, aligning Nigeria with global enforcement trends in the United States, United Kingdom, and European Union, where Meta and other major technology firms have faced multibillion-dollar fines for similar violations.

However, documents from a subsequent settlement indicate that Nigeria reversed its position in October 2025.

Under the agreement, Meta was absolved of the $32.8 million penalty and required only to cover legal fees incurred by the government during court proceedings challenging the NDPC’s final orders.

The settlement was signed on 30 October 2025 and later validated by the Federal High Court in Abuja on 3 November 2025.

Despite this judicial confirmation, the terms of the agreement were not made public at the time, and only recently emerged through disclosed documentation.

The development has triggered questions about transparency in regulatory enforcement, particularly given the scale of the initial allegations and the number of affected users.

Iliya-Ezekiel Ndatse, data protection lawyer, said the outcome weakens regulatory deterrence.

“Removing penalties after such findings reduces the effectiveness of enforcement actions and weakens the credibility of compliance obligations,” he noted.

The case has also drawn comparisons with Nigeria’s previous dispute involving Twitter, now rebranded as X, which was banned in 2021 before the two parties reached a negotiated resolution.

Kaspersky ICS CERT discovered a hardware-level vulnerability affecting Qualcomm chipsets that are widely used in a range of consumer and industrial devices, including smartphones and tablets, car components, IoT devices and more.

The vulnerability resides in the BootROM – firmware embedded at the hardware level. Attackers could potentially get access to any data stored on the device or device sensors like camera and microphone, implement complicated attack scenarios and in some circumstances get full control of the device. The results of the research were presented at Black Hat Asia 2026.

The vulnerability affects Qualcomm MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952 and SDX50 series and was reported to Qualcomm in March 2025. Qualcomm formally acknowledged the vulnerability in April 2025. It has been assigned a CVE-2026-25262. Other Qualcomm-based chips may be affected as well.

Kaspersky researchers explored the Sahara protocol, a low-level communication system used when a Qualcomm chip enters Emergency Download Mode (EDL) – a special recovery mode designed for repairing or restoring smartphones or other devices. Sahara acts as the first step that allows a computer to connect to the device and load software before the operating system on the device starts.

Kaspersky demonstrated that a security flaw in this process could allow an attacker with physical access to the target device to bypass key security protections in the chip, compromise the secure boot chain and, in some cases, deploy malicious applications and backdoors to the chip’s Application Processor, thus fully compromising the entire device.

For example, in cases when the target device is a smartphone or a tablet, the attacker can potentially get access to entered user passwords, and subsequently this opens further access to multiple types of sensitive user data, such as files, contacts, location, access to the devices’ camera and microphone, etc.

A potential attacker only needs a few minutes of physical access to a device to compromise it. Therefore, if a smartphone has been sent for repair or left unattended for a short time, one can no longer be sure it is not infected. Researchers warn that the threat extends beyond end-user scenarios to include potential compromise during the supply chain phase.

“Vulnerabilities like this may allow attackers to deploy malware that is difficult to detect and remove. In practice, this could enable covert data collection or influence device behaviour over extended periods of time.

“While a reboot might seem like an effective way to remove such malware, it cannot always be relied upon: compromised systems may simulate a reboot without actually resetting. In such cases, only a complete loss of power – including battery depletion – guarantees a clean restart,” comments Sergey Anufrienko, security expert at Kaspersky ICS CERT.

Kaspersky advises organisations and individual users to exercise strict physical security control over devices including at the supply, maintenance and decommissioning phases. A reboot of the device by cutting off the power supply to the affected chip (if available) or full battery discharge may help to get rid of the malware if it was installed.

A recent Kaspersky survey entitled “Cybersecurity in the workplace: Employee knowledge and behaviour”, showed that 39% of professionals in the Middle East, Turkiye and Africa (META) region, consider cybersecurity rules in their company to be excessive or not fully appropriate.

While 7% noted that their organisations do not have cybersecurity rules or that they are not aware of them. These results show a disconnect between corporate cybersecurity policies and employee commitment to these rules, underscoring the risks associated with shadow IT and unmanaged device usage in the workplace.

Shadow IT is defined as the use of unauthorised software, devices, or services without IT oversight, and it has evolved into a critical business risk. While often driven by employee productivity needs, it creates blind spots for IT departments.

The rise of hybrid work environments, increased reliance on cloud-based tools and the spread of AI tools have accelerated this trend. Without robust cybersecurity management and oversight, organisations face heightened exposure to ransomware attacks, data leaks, and regulatory penalties.

19% of survey respondents in the META region said there are no policies regarding the use of non-corporate devices in their company. 35% of employees admitted that they can use their own devices to access business information, provided they have some type of cybersecurity protection, even consumer-grade software.

On the positive side, 21% said they can use their own device, but these must first pass more stringent corporate IT security checks; while 25% of respondents indicated that only devices provided by the IT function can be used for work purposes.

The situation is significantly better with permissions for employees to install software on corporate devices without IT department’s approval. 50% reported that only IT specialists in their company are allowed to install software, while in 31% of organisations only top management or designated users can do so. 11% of employees can install software that is approved by the IT team. However, 8% of respondents said that all users can install any software they need without IT agreement in their organisation.

At the same time 21% of professionals surveyed acknowledged that within the past year they installed software on their work devices without IT supervision. That highlights a persistent shadow IT challenge that continues to expose organisations to security vulnerabilities, compliance risks, and data breaches.

“Shadow IT is now a mainstream operational risk. When one in five employees installs software without IT oversight, it signals a policy gap. Many organisations already have security policies in place, but employee perception must also be considered.

Organisations should move beyond restrictive controls and instead implement intelligent, user-centric cybersecurity strategies that combine strategies that integrate technology with employee awareness and responsible use,” said Toufic Derbass, Managing Director for the META region at Kaspersky.