Nigeria Faces Systemic Cyber Risk as Weekly Attacks Surge Past 4,700
Nigeria is grappling with an escalating cybersecurity crisis, recording an average of over 4,700 cyberattacks weekly since the start of 2026. This alarming trend underscores a systemic risk that transcends traditional IT responsibilities, impacting economic stability, public confidence, and the continuity of essential services across the nation’s rapidly expanding digital landscape.
Anthony Fakiyesi, a prominent cybersecurity professional, issued a stark warning that relying solely on data localisation within Nigeria offers insufficient protection against the burgeoning digital threats. While acknowledging the strategic intent behind measures like the Central Bank of Nigeria’s data localisation directive—aimed at enhancing control over critical financial and customer data and bolstering digital sovereignty—Fakiyesi stressed that such efforts are limited if the underlying systems and identities granting access remain vulnerable. He emphasised the critical need for robust identity management, stringent access controls, and diligent monitoring of third-party vendors and technology providers. True data control, he argued, must be underpinned by an organisation’s capacity to withstand, detect, and recover from cyber incidents.
The nature of cyber threats is evolving, with attackers increasingly eschewing purely technical exploits in favour of leveraging stolen credentials and compromised identities. This shift means malicious actors can often infiltrate networks undetected by traditional security alerts, making it challenging to differentiate between legitimate user activity and cybercrime. The first quarter of 2026 alone saw over 281,000 Nigerian user accounts reportedly leaked, with sectors such as banking, fintech, telecommunications, and government institutions identified as prime targets due to their extensive holdings of sensitive personal, financial, and institutional information.
Furthermore, organisations face significant risks inherited from their digital supply chains. Weaknesses in connected vendors, software platforms, cloud services, and other third-party tools create additional attack vectors. Many major cyber incidents in 2026 have followed a pattern of entry through legitimate credentials or trusted third-party access, highlighting the imperative for businesses to rigorously vet all external systems permitted to connect to their networks or handle sensitive data.
A lack of transparent public reporting on cyber incidents further hampers Nigeria’s collective defence. Inadequate disclosure impedes the identification of recurring attack methodologies and the sharing of crucial lessons learned, thereby weakening overall protection. Fakiyesi advocated for stronger incident-reporting standards and enhanced cooperation among private organisations, public institutions, and cybersecurity authorities to foster a more resilient national cybersecurity posture.
The financial ramifications are substantial, with cybercrime costing Nigeria an estimated $500 million annually. This figure is projected to rise as more economic and governmental activities migrate online. Fakiyesi urged organisations to reframe cybersecurity expenditure not as an optional technical cost, but as a vital investment in business continuity and public trust, essential for navigating the opportunities and risks of Nigeria’s expanding digital economy. Strengthening resilience requires a multi-faceted approach, including enhanced identity protection, continuous access monitoring, robust third-party risk management, and effective incident response and recovery plans.
