Nigeria’s data watchdog has issued an urgent nationwide alert, warning that shadowy cyber threat actors are mounting coordinated attacks on the country’s financial systems and critical digital infrastructure.
The Nigeria Data Protection Commission (NDPC) described the situation as escalating, urging banks, fintech firms, government agencies, and other data handlers to fortify their defenses or risk legal consequences immediately.
In a formal regulatory advisory released on Thursday, the NDPC said its technical assessment had uncovered “coordinated operations” by threat actors specifically targeting systems that power banking services, payment platforms, telecommunications, cloud infrastructure, and public-sector digital services.
The commission did not name specific institutions under attack. Still, it made clear that the threats pose a direct risk to the personal data of millions of Nigerians who rely on these platforms for everyday transactions, from mobile money transfers to salary payments and government services.
“The commission strongly advises that data controllers and processors (including MDAs) are to urgently step up their technical and organizational measures to ensure the privacy of all Nigerians and other data subjects in line with the Nigeria Data Protection Act, 2023 (NDP Act),” the advisory stated. It was signed by Babatunde Bamigboye, Esq., Head of Legal, Enforcement, and Regulations at the NDPC.
The warning comes at a pivotal moment for Nigeria’s booming digital economy. With fintech giants processing billions of naira daily and the Central Bank of Nigeria pushing cashless policies, the financial sector has become an attractive target for cybercriminals.
The NDPC’s alert follows closely on the heels of its ongoing investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other entities—an incident that has already heightened regulatory scrutiny across the payments ecosystem.
President Bola Tinubu’s earlier directive was also referenced in the advisory: “Data is the new oil; its value increases the more it is refined and responsibly shared. I therefore direct all ministries, extra-ministerial departments, and agencies to capture information rigorously and safeguard it under the Nigeria Data Protection Act 2023.” The NDPC reminded public and private organizations that failure to comply could result in legal liabilities.
To counter the threats, the commission issued a detailed list of mandatory steps.
Organizations must:
- Appoint trained and certified Data Protection Officers;
- Implement comprehensive privacy policies and conduct Data Privacy Impact Assessments;
- Deploy robust identity and access controls, including multi-factor authentication (MFA);
- Adopt a zero-trust security architecture and network segmentation;
- Ensure continuous patch management to fix system vulnerabilities.
- Secure cloud infrastructure, APIs, databases, and access credentials;
- Implement real-time monitoring, logging, and threat detection systems;
- Use encryption and secure credential handling.
- Conduct regular vulnerability assessments and penetration testing (VAPT);
- Maintain tested backup, recovery, and resilience procedures.
Industry experts say the advisory reflects a growing realization that Nigeria’s rapid digital transformation has outpaced its cybersecurity readiness. Recent years have seen a surge in ransomware attempts, credential theft, and data leaks targeting banks and fintechs, with dark-web marketplaces reportedly trading Nigerian financial data. The NDPC’s move is seen as both a defensive measure and a regulatory signal that enforcement will be strict.
NDPC officials emphasized that the commission remains committed to supporting compliance while holding organizations accountable. “The Commission remains committed to protecting personal data, strengthening institutional resilience, and ensuring compliance across all sectors,” Bamigboye stated.
For ordinary Nigerians, the implications are stark: a successful breach could expose bank details, BVN numbers, phone records, and other sensitive information, fueling identity theft, fraud, and financial losses.
As the advisory circulates through boardrooms and government offices, the message from Abuja is unmistakable—in the age of digital finance, robust data protection is no longer optional; it is a national imperative.
WHAT YOU SHOULD KNOW
Nigeria’s financial systems and critical digital infrastructure are under active, coordinated cyber threats, as urgently warned by the Nigeria Data Protection Commission (NDPC).
The single most important takeaway: Every bank, fintech company, government agency, and organization handling personal data must immediately strengthen their cybersecurity and data protection measures—or face legal consequences.
Robust data protection is no longer optional; it is a national imperative to safeguard millions of Nigerians from potential breaches, identity theft, and financial losses.