Cyber Threats Intensify Against Nigeria’s Digital Drive

* Over 30 Nigerian firms breached, including government institutions

Omolabake Fasogbon

Nigeria’s expanding digital economy is facing a new and more complex test, as a wave of recent cyber incidents affecting financial institutions, fintech platforms, and public sector systems points to what may be a coordinated and evolving threat landscape. While initial reports have focused on isolated breaches, emerging patterns suggest something broader, more structured and potentially systemic.

To fully grasp the implications, it is important to understand how such attacks typically unfold. Cyber intrusions are rarely random. In many cases, threat actors gain unauthorised access to systems, extract or threaten to expose sensitive data, and then amplify the breach through public claims designed to trigger reputational damage. In some instances, access is monetised through underground markets; in others, particularly in emerging markets, the objective leans more towards blackmail, disruption, or signalling capability. The combination of technical compromise and psychological pressure is what often gives these incidents their outsized impact.

Early indications from Nigeria’s current situation suggest that multiple entities may have been targeted across different sectors, including one state government system, three money deposit banks, two fintech platforms, one federal university, other public sector institutions and about 30 other Nigerian companies. This breadth has raised concerns that the incidents may not be limited to a single vulnerability or actor. Instead, it reflects a pattern seen globally, where coordinated or parallel attacks are used to test the resilience of interconnected systems while eroding public confidence in digital infrastructure.

This shifting reality reframes the conversation. What might initially appear as a series of unrelated breaches begins to take on the characteristics of a national challenge, one that sits at the intersection of cybersecurity, economic stability, and public trust. As Nigeria continues to digitise payments, public services, and identity systems, the visibility and value of its infrastructure inevitably increase its attractiveness as a target.

The Federal Government has acknowledged the urgency of strengthening the country’s cyber defences. The Minister of Communications, Innovation and Digital Economy, Dr Bosun Tijani, recently outlined plans to establish a Cybersecurity Coordination Council aimed at improving collaboration between government agencies, private sector operators and critical stakeholders. The proposed framework is expected to enhance intelligence sharing, streamline response mechanisms, and build a more unified national posture against cyber threats.

However, questions remain about the current framing of the situation. In its April 5 press statement, the Nigeria Data Protection Commission referenced specific organisations in relation to ongoing investigations while also alluding to other entities. This has prompted a key question within industry circles: if the issue is as widespread as emerging reports suggest, why highlight only a few entities while grouping the rest under “others”? Who are the others? In a situation that appears to cut across multiple institutions, greater clarity may be critical to ensuring that the full scope is properly understood and addressed.?

According to Epa Stevens, a financial analyst and public affairs commentator, the emerging pattern reflects more than routine intrusion activity. “What we are seeing has the characteristics of a coordinated pressure test rather than random attacks. The spread across sectors suggests either multiple actors or a shared playbook operating across jurisdictions. No serious system is completely immune. The real issue is resilience, how quickly threats are detected, contained and operations stabilised,” he noted.

Stevens also pointed to the strategic dimension of such incidents. “These situations often follow a familiar pattern. Attackers gain some level of access and then amplify the narrative publicly to create pressure. It is not always about the depth of the breach, but the perception it creates. What matters is whether core systems continue to function. From available indications, most institutions have maintained operational continuity, which is a critical signal of underlying resilience,” he said.

This perspective aligns with the views expressed by leading technology thinker Chris Uwaje, Co-Founder, Past President and Fellow of the Institute of Software Practitioners of Nigeria (ISPON), in his recent piece, ‘The Software Bug, Lessons for Nigeria,’ published on April 5. Uwaje argues that cyber incidents are an inevitable by-product of technological advancement, drawing a parallel with other systemic risks that cannot be entirely eliminated. As he puts it, software vulnerabilities, much like accidents in other domains, are an inherent reality that must be anticipated and managed, not wished away. He further emphasises that Nigeria’s digital future will depend on how effectively it builds trust, resilience, and indigenous capacity in the face of these challenges.

Yet, beyond the technical and policy dimensions, there is also a strategic layer worth considering. Could the current wave of incidents be part of a broader attempt to probe the strength of Nigeria’s digital infrastructure? Are threat actors simply exploiting opportunistic vulnerabilities, or is there a more coordinated effort to test response capabilities across sectors? In an era where cyber operations increasingly intersect with economic and geopolitical interests, such questions are not merely speculative, they are essential to forming a complete picture.

What is clear is that the implications extend beyond any single organisation. Framing the issue as a failure of individual institutions risks missing the larger point. Cyber threats of this nature are rarely confined; they are distributed, adaptive, and often borderless. Addressing them effectively requires a shift from fragmented responses to a more integrated, ecosystem-wide approach.

A cybersecurity expert affiliated with the Nigerian Computer Society, who requested anonymity due to regulatory considerations, also opined that cyber incidents are a regular occurrence globally, not unique to any one platform or country. “Organisations across the world face similar threats daily, including major international banks and technology firms. No organisation in the world is immune to attack, not even Pentagon, FBI and CIA. What matters is the speed of response and system resilience,” he said.

Encouragingly, there are indications that core financial operations across affected institutions remain stable, with no confirmed disruption to transaction flows at a systemic level. At the same time, claims made by various threat actors continue to be investigated, with forensic reviews and regulatory processes underway to establish verified facts.

Against this backdrop, there is a growing view that the priority at this stage should be coordination rather than enforcement. While regulatory oversight remains essential, moments such as this call for institutions to work collectively with operators and industry stakeholders to strengthen systemic defences, rather than prematurely framing the situation through the lens of penalties.

The path forward demands more than reactive measures. It calls for deeper collaboration between regulators, operators and international partners, alongside sustained investment in cybersecurity infrastructure, talent and awareness. It also requires a careful balancing of priorities, ensuring that efforts to enforce compliance do not overshadow the more immediate need to strengthen collective defences against an evolving threat environment.

Ultimately, Nigeria’s response to this moment will help define the trajectory of its digital economy. As the country continues to build and scale its technology ecosystem, cybersecurity will remain a central pillar, not only as a line of defence, but as a foundation for trust, growth and long-term resilience.

https://meet.google.com/call?authuser=1&hl=en&mc=KAIwAZoBFDoScGludG9fdjFscXQ4Yms5YzAwogE7GgIQADICUAA6AhABSgQIARABWgIIAGoCCAFyAggBegIIAogBAZIBAhABmgEEGAEgAKIBAhAA4gECCACyAQcYAyAAKgExwgECIAHYAQE&origin=https%3A%2F%2Fmail.google.com&iilm=1775497218057