What Nigerian companies, regulators, others must do to prevent prevailing cyber attacks – Experts

Cybersecurity experts have suggested areas in which Nigerian companies, regulators, and other entities can strengthen their digital resilience and prevent prevailing cyber attacks.

The experts spoke against the backdrop of recent incidents of cyber attacks recorded across the country.

The rapid adoption of digital technology has transformed Nigeria’s corporate landscape, making financial services, business registration, and other transactions faster and more convenient.

However, this digital transformation has also exposed organisations to growing cybersecurity threats, with public and private institutions reportedly experiencing cyber incidents in recent months.

Among the most prominent cases are allegations by a hacker known as ByteToBreach, who claimed responsibility for attacks targeting organisations including Remita, Sterling Bank, Zenith Bank, the Oyo State Government, Leadway Assurance, GetBumpa, Ahmadu Bello University (ABU), Zaria, and the Corporate Affairs Commission (CAC).

The hacker also claimed to possess more than three terabytes of sensitive data allegedly obtained from the affected organisations.

Based on cybersecurity experts’ analysis of ByteToBreach’s claims, the alleged attacks involved an unpatched internet-facing server, weak credential management, poor network segmentation, trusted third-party integrations, weak access controls, predictable user identifiers, and insecure system design from the affected companies.

Checks showed that these cyber incidents and technical claims were not publicly confirmed by the organisations involved. In many cases, the only official announcement came from the Nigeria Data Protection Commission (NDPC), which disclosed that it had initiated investigations.

Nigerian institutions also rarely notify customers when their personal data may have been compromised, nor do they typically issue public apologies or explain the measures being taken to address such breaches.

In April, NDPC announced that it had commenced an investigation into the alleged data breaches involving Remita Payment Services Ltd., Sterling Bank, the CAC, and other entities.

Under Nigeria’s legal framework, companies are not generally required by the Constitution or the Cybercrimes Act to notify customers after every cyberattack.

However, the Nigeria Data Protection Act (NDPA) 2023 requires organisations to notify the NDPC within 72 hours of becoming aware of a personal data breach that is likely to pose a risk to individuals.

Where such a breach is likely to result in a high risk to the rights and freedoms of affected individuals, organisations are also required to notify those individuals without undue delay.

The law therefore requires organisations to assess the nature and potential impact of a personal data breach before determining whether customer notification is mandatory.

The CAC, for instance, was very careful in its data breach announcement, stating that there had been “unauthorised access to limited aspects of its information systems,” but the artefacts published by the hackers claimed the hackers possessed over 25 million documents from the CAC’s system.

The breach at the CAC extends beyond the commission itself. As Nigeria’s corporate registry, it maintains sensitive records on millions of registered businesses, including company registration details, directors’ and shareholders’ information, beneficial ownership records, registered addresses, incorporation documents, and statutory filings.

If accessed by malicious actors, such information could be exploited for corporate fraud, identity theft, phishing attacks, and the impersonation of businesses or company officials.

Meanwhile, the Federal Government has only disclosed plans in April to establish a Cybersecurity Coordination Council with private-sector participation to strengthen Nigeria’s collective cyber resilience in response to evolving cyber threats across the public and private sectors.

Attack causes

Cybersecurity experts have criticised Nigeria’s approach to cybersecurity oversight, arguing that regulators have historically placed greater emphasis on regulatory compliance than on the actual effectiveness of organisations’ security controls, allowing vulnerable institutions to manage sensitive data.

They also contend that regulators rely too heavily on organisations’ self-assessments of their cybersecurity posture instead of conducting independent and transparent evaluations, describing the approach as more performative than effective.

For instance, in March 2026, the Central Bank of Nigeria (CBN) introduced a mandatory Cybersecurity Self-Assessment Tool (CSAT), requiring banks and other regulated financial institutions to assess and report their cybersecurity posture as part of efforts to strengthen cyber resilience and enhance regulatory oversight.

Speaking to PREMIUM TIMES on the vulnerabilities the attackers claimed to have exploited, cybersecurity expert and Senior Data Analyst at Ceresense Training Institute, Samuel Tomori, said the recent cyber incidents involving major Nigerian institutions reveal a more fundamental problem than sophisticated hacking.

“The recent wave of cyberattacks on major Nigerian institutions, including Sterling Bank, the CAC, and Remita, is a brutal wake-up call. But if you look at how these breaches actually happened, the frustrating reality is that the attackers did not use futuristic, unpreventable exploits. They basically walked through doors that were left unlocked,” he said.

According to Mr Tomori, the incidents suggest that many organisations continue to prioritise regulatory compliance over building genuinely secure systems.

“It is not like the attackers are using any sophisticated tools. The fallout shows that too many companies across the country are relying on basic compliance checklists rather than examining how their networks actually operate. If they do not fix the underlying architecture, these headlines will just keep happening,” he said.

Mr Tomori argued that one of the biggest changes Nigerian organisations need to make is abandoning the assumption that systems within their networks or those of trusted partners are automatically secure.

“Nigerian institutions need to stop assuming ‘internal’ means ‘safe.’ For years, the standard playbook has been to build a strong perimeter. They assumed that if a partner network, such as a bank, connected to an aggregator like Remita, that connection was safe because they knew who they were.

“The Sterling-to-Remita link showed exactly why this model is dead,” he said, referring to ByteToBreach’s claim that Remita was accessed through Sterling Bank.

He explained that once attackers gain access through a seemingly insignificant server, they can exploit trusted connections to move into more sensitive systems.

“Once an attacker breaches a minor, non-critical server on one side, they can use that trusted pipeline to slide straight into core systems.

“Nigerian institutions need to adopt a Zero Trust mindset. Every API request, even if it is from a trusted local partner or an external service, must prove its identity and authorisation every time,” he added.

Mr Tomori also warned against poor credential management, describing it as the equivalent of leaving a house key where anyone can find it.

“Most institutions usually leave their house key under the mat. Leaving API keys, tokens, or database passwords hardcoded in configuration files or exposed in repository code is dangerous. Attackers use automated bots that scan the internet for these exact blunders 24 hours a day, seven days a week,” the cybersecurity expert said.

Preventive measures

Speaking in a similar vein, cybersecurity expert, researcher, and founder of Cybarik, Iretioluwa Akerele, said the attacks were not necessarily the work of highly sophisticated hackers.

“The common thread across the reported incidents is clear. These attacks did not depend on sophisticated nation-state capabilities. Instead, they exploited fundamental gaps in cyber hygiene, governance, and security controls,” she said.

The expert argued that Nigerian organisations must move beyond viewing cybersecurity as a compliance exercise and instead adopt a risk-based approach aligned with regulatory requirements, industry standards, and global best practices.

According to Ms Akerele, one of the first lines of defence against cyberattacks is ensuring that systems are regularly tested and updated.

ALSO READ: Cyberstalking Allegations: ABC Transport founder Frank Nneji’s daughter loses bid to stop arrest

She advised organisations to conduct routine vulnerability assessments and penetration testing, maintain an up-to-date inventory of information assets, monitor internet-facing systems for exposed services, and implement formal patch management policies to ensure security updates are installed promptly.

She noted that these measures are consistent with the Nigeria Data Protection Act (NDPA) 2023, which requires organisations to implement appropriate technical and organisational measures to protect personal data.

Strengthen access controls

Weak identity and access management remain one of the leading causes of unauthorised access to corporate systems, according to the cybersecurity expert.

To address this, Ms Akerele recommended the use of multi-factor authentication (MFA) for privileged and remote access, the application of the Principle of Least Privilege (PoLP), regular reviews of user access rights, and the prompt removal of access for former employees.

She also advised organisations to eliminate shared administrator accounts and deploy Privileged Access Management (PAM) solutions for critical systems.

According to her, strong identity and access controls significantly reduce the risk of compromised credentials being used by attackers.

Ms Akerele stressed the need for proper network segmentation by separating critical systems from user networks, isolating production, development, and testing environments, and restricting network traffic.

The cybersecurity expert also urged companies to adopt a Zero Trust security model, where no user or device is automatically trusted. She added that a single compromised system should not expose an entire organisation.

“Effective segmentation ensures that a single breach does not escalate into a full-scale compromise,” she said.

Third-party relationships

Ms Akerele also highlighted the risks associated with third-party relationships, noting that as organisations increasingly rely on vendors and digital service providers, cybersecurity risks can extend beyond their own networks.

She advised companies to conduct cybersecurity due diligence before engaging vendors, include clear security obligations in contracts, and regularly assess vendors’ cybersecurity posture, monitor Application Programming Interface (API) access, and ensure third parties comply with data protection requirements.

She noted that under the NDPA, organisations remain responsible for protecting personal data even when processing activities are outsourced.

According to Ms Akerele, who is also a cybersecurity lecturer, cybersecurity must not be treated as an afterthought once applications have been developed.

She recommended embedding security throughout the software development life cycle by conducting secure code reviews, implementing API security controls, preventing vulnerabilities such as Insecure Direct Object Reference (IDOR), using unpredictable object identifiers, and conducting penetration testing before deployment.

She also urged developers to follow internationally recognised standards such as the Open Worldwide Application Security Project (OWASP) Top 10.

“Security should be built into systems by design, not retrofitted after deployment,” she said.

Ms Akerele said businesses should establish continuous security monitoring by deploying Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) solutions, monitoring privileged account activity, detecting unusual login behaviour, and maintaining centralised logs across critical systems.

She encouraged organisations to conduct regular cybersecurity awareness training, phishing simulations, and staff education on password security and social engineering.

The cyber researcher also recommended that executives and board members receive cyber risk governance training.

“Technology alone cannot compensate for poor security awareness,” she said.

Ms Akerele advised organisations to establish dedicated incident response teams, define escalation and communication procedures, conduct regular cyber simulations, maintain secure offline backups, and routinely test disaster recovery and business continuity plans.

She explained that the objective is not only to prevent attacks but also to ensure organisations can recover quickly when incidents occur.

Beyond technical controls, Ms Akerele insisted that effective governance is critical to improving cyber resilience.

She urged organisations to align their cybersecurity programmes with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Commission (NDPC) Guidelines, and the Cybercrimes Act, the National Cybersecurity Policy and Strategy, as well as international frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework.

The expert also recommended that boards receive regular cyber risk reports and treat cybersecurity as an enterprise-wide business risk rather than merely an information technology issue.

Ms Akerele further advised organisations to conduct regular risk assessments covering critical business assets, emerging cyber threats, data processing activities, third-party risks, compliance gaps, and the potential business impact of cyber incidents.

She added that building cyber resilience requires a layered approach combining effective governance, strong access controls, secure system design, continuous monitoring, employee awareness, vendor risk management, and compliance with both the NDPA and globally recognised cybersecurity standards.

“Organisations are most often compromised through known and preventable weaknesses, not advanced attack techniques,” Ms Akerele said.