E-Business
Nigeria Cyberattacks: Stronger Collaboration as a Panacea
A series of recent cybersecurity incidents affecting financial institutions, government-linked platforms, and fintech operators is beginning to reveal a pattern that can no longer be ignored. What may have initially appeared as isolated breaches is now raising deeper concerns about a broader and possibly coordinated threat landscape targeting the country.
At the heart of this conversation is a critical shift in perspective. Cybersecurity incidents must no longer be viewed as problems belonging to individual organisations. They represent a national risk. The growing frequency and spread of these attacks suggest that no institution is immune, and more importantly, that those not yet affected cannot afford complacency. For organizations that have not experienced any disruption, this is not a moment for reassurance. The emerging pattern suggests it may only be a matter of time.
The growing concern follows a wave of alleged cyber incidents targeting organizations across banking, fintech, government, insurance, and education sectors, raising fears that sensitive data belonging to millions of users may be at risk.
At the centre of the unfolding situation are bank customers, fintech users, government workers, and students, whose personal and financial information could be exposed if the claims are substantiated. What initially appeared as isolated breaches is now being viewed as a potentially broader and more coordinated threat affecting Nigeria’s digital infrastructure.
Against this backdrop is a post by @TrendingEx on X (formerly Twitter), which claimed that more than 3TB of sensitive data linked to multiple Nigerian organizations had been published online. The post listed entities including Remita, Sterling Bank, Zenith Bank, the Oyo State Government, Leadway Assurance, GetBumpa, and Ahmadu Bello University, alongside more than 30 other companies.
Beyond these cases, the breadth of organizations named has raised deeper concerns about systemic exposure. The entities span financial services, public sector systems, insurance providers, fintech platforms, and academic institutions, suggesting that attackers may be probing shared weaknesses rather than targeting single organizations in isolation.
Cybersecurity incidents of this nature typically involve attackers exploiting technical vulnerabilities or misconfiguration to gain access, followed by the extraction of sensitive data. Such data is often used for extortion, fraud, or public leaks. In some cases, the scale of access may be overstated, but even limited breaches can have far-reaching consequences when systems are interconnected.
What makes the current situation particularly concerning is not just the incidents themselves, but their apparent timing and spread. The near-simultaneous emergence of cybersecurity concerns across banking, fintech, and public sector systems suggests a broader systemic vulnerability. From institutions such as Flutterwave to Fidelity Bank, past and recent incidents continue to illustrate that no segment of the ecosystem is insulated from risk.
Cybercriminal tactics in these scenarios often follow a familiar pattern. Attackers typically seek to gain initial access through technical vulnerabilities or misconfiguration. Once inside, they may attempt to extract sensitive data which is then used as leverage. In many cases, organizations are approached with demands, with the threat of public exposure if compliance is not met.
However, not all claims made by threat actors are accurate. In some instances, attackers exaggerate the scale of their access to increase pressure. A breach involving a limited number of records may be presented as a compromise affecting millions. This strategy is designed to create panic, attract attention, and force quicker responses from targeted organizations.
In response to rising cyber risks, the Central Bank of Nigeria has introduced a mandatory cybersecurity self-assessment for banks and financial institutions, signalling tighter regulatory scrutiny across the sector.
At the policy level, the Minister of Communications, Innovation and Digital Economy has also emphasized the importance of collaboration in strengthening national cyber resilience, highlighting the need for stronger coordination between government and the private sector.
Despite these developments, experts warn that the public narrative must be handled carefully. Focusing solely on individual organisations risks overlooking the broader issue of systemic vulnerability. More importantly, isolating affected institutions could discourage transparency and delay information sharing, both of which are critical in responding effectively to cyber threats.
The wider implication is that cybersecurity incidents can no longer be treated as isolated corporate challenges. As digital systems become increasingly interconnected, a breach in one organization can have ripple effects across multiple sectors, undermining trust in the broader digital economy.
For individuals, the risks are immediate and tangible. Data breaches can expose personal information, enabling identity theft, financial fraud, and targeted cyberattacks. This makes vigilance essential not just for institutions, but for everyday users who rely on digital platforms.
While the full extent of the alleged breaches remains unclear, the pattern of claims, their timing, and the range of organizations involved point to a critical moment for Nigeria’s cybersecurity landscape.
Whether these incidents are ultimately confirmed or not, they underscore a growing reality: in an interconnected digital environment, the security of one organization is closely tied to the security of all.
Gbolabo Awelewa, chief Business Officer, Esentry, said that industry-wide collaboration is critical. Cyberattacks targeting banks and payment platforms are becoming more coordinated and sophisticated, and no single organization can address them alone.
“Stronger collaboration between financial institutions, fintechs, regulators, and cybersecurity providers will enable faster threat intelligence sharing and a more unified response to emerging risks.
“At esentry, we see first-hand how proactive security measures make a significant difference. Organizations need continuous monitoring of their infrastructure, regular vulnerability assessments, stronger identity and access management, and real-time threat detection capabilities to identify and respond to attacks before they escalate.
“Beyond technology, institutions must also prioritize resilience; ensuring they can detect, respond to, and recover quickly from incidents.
“Ultimately, cybersecurity today is an ecosystem challenge, and organizations that combine strong security frameworks with industry collaboration will be better positioned to stay ahead of evolving threats,” he stated.
However, there is a growing concern that public discourse may be drifting in the wrong direction. Focusing on blame or singling out affected organisations risks undermining collective security. When institutions are publicly isolated, it may discourage transparency and delay critical information sharing, both of which are essential in responding to cyber threats effectively.
More importantly, a fragmented approach can embolden attackers. When threat actors perceive a lack of unity, they are more likely to expand their activities, targeting additional organizations and exploiting systemic weaknesses. This makes it imperative for stakeholders to adopt a unified stance.
The current moment calls for a shift from reaction to coordination. Regulators, private sector players, and cybersecurity professionals must work together to build a shared defence framework. This includes timely information sharing, joint incident response strategies, and consistent enforcement of security standards across the ecosystem.
For the public, the implications are equally significant. Data breaches are no longer abstract technical events. They carry real-world risks, including identity theft, financial fraud, and targeted social engineering attacks. As such, awareness and vigilance must extend beyond institutions to individual users who interact with digital platforms daily.
Ultimately, the message is clear. Nigeria’s cybersecurity challenges cannot be addressed in isolation. Whether the threat originates from within or outside the country, its impact is collective. Every breach, regardless of where it occurs, has the potential to weaken trust in the broader digital economy.
Nigeria’s data protection industry has grown into a N16.3 billion ecosystem within three years of formal regulation, according to the Nigeria Data Protection Commission (NDPC).
Olufemi Ibitayo, head of Finance Management and Control, NDPC, announced the milestone at the Regional Data Governance Exchange in Nairobi, Kenya, where he represented Dr Vincent Olatunji, national commissioner and chief executive officer, NDPC.
Presenting Nigeria’s progress, Ibitayo said the country’s strong regulatory framework and the establishment of an independent data protection authority have strengthened confidence in the digital economy and enhanced Nigeria’s reputation as a destination for foreign investment.
The Regional Data Governance Exchange, organised by the Data Governance in Africa Initiative and hosted by the Office of the Data Protection Commissioner in Nairobi, brought together African data protection authorities to strengthen institutional capacity, deepen collaboration and promote peer learning on data governance. Photo: NDPC
He said the Commission’s “Compliance First, Not Punishment” approach encourages organisations to meet their obligations through dialogue and voluntary compliance, while ensuring effective regulatory oversight.
Ibitayo added that the NDPC is developing regulatory technology solutions, a regulatory sandbox and a data privacy innovation laboratory to further strengthen Nigeria’s data governance ecosystem and support future growth.
United Nations Commission on International Trade Law (UNCITRAL)
The ongoing UNCITRAL session has brought together delegates from Nigeria, Australia, China, Ghana, France, the United States and other member states to develop harmonised legal frameworks aimed at facilitating secure, trusted and efficient cross-border digital commerce. Photo: NDPC
Meanwhile, Olatunji reaffirmed Nigeria’s commitment to global data governance during a meeting with Nigeria’s Permanent Representative to the United Nations, Ambassador Jimoh Ibrahim.
He made the remark on the sidelines of the ongoing United Nations Commission on International Trade Law (UNCITRAL), where Nigeria is participating alongside delegates from several member states to advance harmonised legal frameworks for secure and trusted cross-border digital commerce.
The NDPC boss highlighted the Commission’s achievements since its establishment, noting that strategic institutional reforms have positioned Nigeria as a leading voice in the global data protection ecosystem.
He said the country’s data protection framework has continued to earn international recognition, adding that the Commission remains committed to promoting trusted data governance as a driver of digital transformation, economic growth, innovation and sustainable development in line with the Renewed Hope Agenda of President Bola Ahmed Tinubu.
During the meeting, Ambassador Ibrahim commended the Commission’s progress since the enactment of the Nigeria Data Protection Act 2023 and called for the establishment of a comprehensive national data bank to support evidence-based policymaking, research and national development.
National Identity Management Commission (NIMC) has said thet more than 136 million Nigerians and legal residents have been enrolled in the National Identity Database (NIDB).
In a statement on Tuesday, Kayode Adegoke, head of corporate communications, NIMC, said Abisoye Coker-Odusote, chief executive officer (CEO) of the commission, announced the milestone during a courtesy visit to the ministry of budget and economic planning.
In April 2025, NIMC said over 117.36 million Nigerians had been enrolled as of February 28, 2025.
The visit was part of the commission’s ongoing stakeholder engagements with ministries, departments and agencies (MDAs) on the implementation of the NIMC Act 2026.
Presenting the new Act, Coker-Odusote said the legislation repeals and replaces the 2007 NIMC Act, modernising Nigeria’s digital identity ecosystem by positioning the national identification number (NIN) as the country’s foundational identity under the “one person, one identity” policy.
She said the law also establishes NIMC as the root certificate authority for the national digital infrastructure and introduces stronger data protection and cybersecurity measures, as well as digital credentials.
“The Federal Government remains committed to enrolling and issuing NINs to all Nigerians and legal residents within the shortest possible time,” Coker-Odusote said.
She added that NIMC is ready to collaborate with the ministry of budget and economic planning to leverage the NIN for economic planning and national development initiatives.
Speaking during the visit, Abubakar Atiku Bagudu, the minister of budget and economic planning, reaffirmed the federal government’s commitment to the implementation of the NIMC Act 2026.
Bagudu described the legislation as “a transformative milestone” that would strengthen Nigeria’s digital identity ecosystem and accelerate national planning and development.
He commended the NIMC director-general and the commission’s leadership for their efforts in securing the passage of the legislation, noting that it provides “a solid legal foundation for a trusted, secure, and inclusive national identity management system”.
The minister, however, said the true measure of the Act’s success would lie in its implementation and the benefits it delivers to Nigerians.
“The true measure of the Act’s success will lie in its effective implementation and the tangible benefits delivered to citizens,” he said.
Bagudu also called for stronger collaboration across the federal, state and local governments to build public confidence in the national identity system and eliminate the duplication of identity databases across government institutions.
He said the NIN should serve as Nigeria’s single, universally accepted identity standard, supporting efficient service delivery and good governance.
On June 26, President Bola Tinubu signed the NIMC Act 2026 into law, repealing the commission’s 2007 establishing Act.
At the time, Olubunmi Tunji-Ojo, minister of interior, said the legislation would strengthen Nigeria’s legal framework for digital identity management, cybersecurity and secure digital authentication, while reinforcing the NIN as the country’s foundational identity credential under the “one person, one identity” principle.
Plateau State Public Complaints Commission (PCC), an agency of the state established to investigate complaints of abuse of office, administrative injustice and other forms of official misconduct is allegedly collecting personal information from members of the public through its website with no privacy policy.
According to investigation by Foundation for Investigative Journalism (FIJ), PCC is falling short of a key transparency requirement under Nigeria’s data protection laws.
FIJ found on Tuesday that PCC collects personal information from members of the public through its website despite providing no privacy policy explaining how that information is collected, processed, stored or protected.
The commission serves as the state’s ombudsman, receiving complaints free of charge against public institutions and private organisations on issues including wrongful dismissal, victimisation and administrative negligence.
Yet, while its online complaint portal requests personal information such as names, phone numbers, email addresses, subject lines and complaint details, visitors are given no privacy notice explaining what becomes of that information after it is submitted.
The omission means visitors are not told why their information is being collected, how long it will be retained, the legal basis for processing it or the rights available to them as data subjects.
WHAT IS THE POSITION OF THE LAW?
The guidelines issued by the National Information Technology Development Agency (NITDA) are explicit: every government website is required to have a privacy policy.
Section 10.4 (i, ii) of the NITDA guidelines mandates all government websites to exercise diligence when collecting personal details or information about visitors on their websites.
The requirement is intended to ensure transparency and accountability in the handling of personal information, allowing visitors to understand why their data is collected, how it will be used and the safeguards in place to protect it.
Similarly, the Nigeria Data Protection Act (NDPA) 2023 requires data controllers to provide privacy notices to individuals before, or at the point of, collecting their personal information.
Such notices are expected to disclose, among other things, the purpose for collecting the data, the legal basis for processing it, the period for which it will be retained and the rights available to data subjects.
Section 27 of the NDPA states:
(1) Before a data controller collects personal data directly from a data subject, the data controller shall inform the data subject of the – (a) identity, residence or place of business of, and means of communication with the data controller and its representatives, where necessary;
(b) specific lawful basis of processing under section 25(1) or 30(1) of this Act, and the purposes of the processing for which the personal data are intended;
(c) recipients or categories of recipients of the personal data, if any;
(d) existence of the rights of the data subject under Part VI;
(e) retention period for the personal data;
(f) right to lodge a complaint with the Commission in accordance with section 46 (1) of this Act; and
(g) existence of automated decision-making, including profiling, the significance and envisaged consequences of such processing for the data subject, and the right to object to and challenge such processing.
Without a privacy policy, visitors have no way of knowing the commission’s data-handling practices or the safeguards, if any, in place to protect the personal information they submit through the website.
At press time, the Plateau State Public Complaints Commission’s website had no privacy policy.
CAC to Sanction Companies with Incomplete Business Letters From August 1
BVN Enrollments Hit 69.55m- NIBSS
CBN Warns against Rejection of N100 Banknotes
Data Protection Industry Hits N16.3Bn in 3 Years- NDPC
NCC Seeks Cost-Based Pricing Framework for Ducts
NASENI Moves to Digitize CCB’s 5m Assets Declaration and Operations
Mobile Internet Gender Gap Widest in Africa – GSMA
Nigeria Launches FreeTV Nationwide
CANAL+ Partners Samsung to Pre-Load DStv Stream on New Samsung TVs In Nigeria, Other African Countries
CredibleVoteNG Opens Free Access to all Polling Units in Nigeria after INEC Demanded N1.Bn for Register
News1 day agoNRC, Ponzi Scheme Collapses Resulting Loss of Billions of Naira
General News2 days agoIHS Nigeria, FCT-HSES Concludes Clean Cooking Energy Campaign “Project Breathe Clean Air” in Abuja
E-Business2 days agoKaspersky Transforms Threat Intelligence Reporting into an Interactive Content Hub
News2 days agoMicrosoft to Lay Off 4,800 Workers
Telecom2 days agoAirtel Africa Cuts Diesel Dependence by 9.1m Litres
Telecom2 days agoA New Blueprint – How Strategic Collaboration is Rewriting the Narrative on Youth Drug Abuse
Broadcasting2 days agoNELFUND Investigates 34 Universities Over Students’ Missing Tuition Refunds
News2 days agoAccess Bank, Fifth Chukker and UNICEF Renew Commitment to Expanding Educational Opportunities for Nigeria’s Most Vulnerable Children