Data Knowledge and Information Privacy Protection Initiative (DKIPPI) has warned that widespread ignorance of data privacy practices is exposing Nigeria to serious national security and economic risks amid a rise in ransomware attacks.

Tokunbo Smith, president of DKIPPI, warned on Tuesday in Lagos, that  the increasing frequency of ransomware incidents underscores the dangers of weak data protection systems across organisations and institutions.

He described ransomware attacks as a growing threat in which hackers infiltrate systems, demand payments and threaten to leak sensitive data.

Mr Smith said, “The cost of ignorance in data privacy is not just what you lose. It is what you expose. Data privacy has evolved beyond a technical concern to a critical governance and national development issue requiring urgent attention. Ransomware is no longer just cybercrime; it is economic warfare and a governance issue.”

Mr Smith urged both public and private sector leaders to adopt proactive and comprehensive data protection frameworks to safeguard sensitive information and strengthen institutional resilience.

He also called on government at all levels to go beyond punitive responses and implement stronger regulations, enforcement mechanisms, and national cyber resilience strategies.

According to him, DKIPPI will soon release a policy advocacy paper outlining the key risks associated with poor data protection practices.

He said the paper would highlight financial losses, institutional inefficiencies, and threats to national security, while recommending urgent reforms to procurement processes, compliance systems, and governance structures.

Mr Smith added that addressing data privacy gaps was critical to protecting Nigeria’s digital economy and restoring trust in its institutions.

Decision to cancel the $32.8 million fine previously imposed on Meta for alleged data privacy violations was taken as far back as October 30, 2025.

The development has raised concerns over the country’s approach to data protection enforcement and regulatory transparency.

This followed a confidential, out-of-court settlement singed by Nigerian Data Protection Commission (NDPC) with Meta, effectively waiving the fine imposed earlier that year.

This deal, sanctioned by a Federal High Court, resolved disputes over behavioural advertising and user data transfers without Meta paying the penalty.

Recall that the NDPC claimed that it launched investigation in September 2023 that examined Meta’s handling of personal data from more than 60 million Nigerian users.

The NDPC had accused Meta of several breaches, including the absence of explicit consent for behavioural advertising, unauthorised cross-border data transfers, the collection of data from non-users, and the deployment of algorithms that could expose users to financial and health risks.

At the time, the regulator described the penalty as part of efforts to strengthen digital rights protections in Africa’s most populous country, aligning Nigeria with global enforcement trends in the United States, United Kingdom, and European Union, where Meta and other major technology firms have faced multibillion-dollar fines for similar violations.

However, documents from a subsequent settlement indicate that Nigeria reversed its position in October 2025.

Under the agreement, Meta was absolved of the $32.8 million penalty and required only to cover legal fees incurred by the government during court proceedings challenging the NDPC’s final orders.

The settlement was signed on 30 October 2025 and later validated by the Federal High Court in Abuja on 3 November 2025.

Despite this judicial confirmation, the terms of the agreement were not made public at the time, and only recently emerged through disclosed documentation.

The development has triggered questions about transparency in regulatory enforcement, particularly given the scale of the initial allegations and the number of affected users.

Iliya-Ezekiel Ndatse, data protection lawyer, said the outcome weakens regulatory deterrence.

“Removing penalties after such findings reduces the effectiveness of enforcement actions and weakens the credibility of compliance obligations,” he noted.

The case has also drawn comparisons with Nigeria’s previous dispute involving Twitter, now rebranded as X, which was banned in 2021 before the two parties reached a negotiated resolution.

Kaspersky ICS CERT discovered a hardware-level vulnerability affecting Qualcomm chipsets that are widely used in a range of consumer and industrial devices, including smartphones and tablets, car components, IoT devices and more.

The vulnerability resides in the BootROM – firmware embedded at the hardware level. Attackers could potentially get access to any data stored on the device or device sensors like camera and microphone, implement complicated attack scenarios and in some circumstances get full control of the device. The results of the research were presented at Black Hat Asia 2026.

The vulnerability affects Qualcomm MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952 and SDX50 series and was reported to Qualcomm in March 2025. Qualcomm formally acknowledged the vulnerability in April 2025. It has been assigned a CVE-2026-25262. Other Qualcomm-based chips may be affected as well.

Kaspersky researchers explored the Sahara protocol, a low-level communication system used when a Qualcomm chip enters Emergency Download Mode (EDL) – a special recovery mode designed for repairing or restoring smartphones or other devices. Sahara acts as the first step that allows a computer to connect to the device and load software before the operating system on the device starts.

Kaspersky demonstrated that a security flaw in this process could allow an attacker with physical access to the target device to bypass key security protections in the chip, compromise the secure boot chain and, in some cases, deploy malicious applications and backdoors to the chip’s Application Processor, thus fully compromising the entire device.

For example, in cases when the target device is a smartphone or a tablet, the attacker can potentially get access to entered user passwords, and subsequently this opens further access to multiple types of sensitive user data, such as files, contacts, location, access to the devices’ camera and microphone, etc.

A potential attacker only needs a few minutes of physical access to a device to compromise it. Therefore, if a smartphone has been sent for repair or left unattended for a short time, one can no longer be sure it is not infected. Researchers warn that the threat extends beyond end-user scenarios to include potential compromise during the supply chain phase.

“Vulnerabilities like this may allow attackers to deploy malware that is difficult to detect and remove. In practice, this could enable covert data collection or influence device behaviour over extended periods of time.

“While a reboot might seem like an effective way to remove such malware, it cannot always be relied upon: compromised systems may simulate a reboot without actually resetting. In such cases, only a complete loss of power – including battery depletion – guarantees a clean restart,” comments Sergey Anufrienko, security expert at Kaspersky ICS CERT.

Kaspersky advises organisations and individual users to exercise strict physical security control over devices including at the supply, maintenance and decommissioning phases. A reboot of the device by cutting off the power supply to the affected chip (if available) or full battery discharge may help to get rid of the malware if it was installed.