Digital Encode Limited, a leading information security and governance, risk, and compliance (GRC) advisory firm, has issued an urgent cybersecurity advisory following a surge in security breaches affecting financial institutions, government agencies, fintechs, and other organizations across Nigeria.
Cyber threat actors have recently exposed data purportedly from both private and public institutions in Nigeria, underscoring the growing need for stronger cybersecurity frameworks, proactive threat monitoring, and coordinated incident response measures.
But Digital Encode’s advisory highlights a troubling pattern: most recent cyber incidents are not driven by sophisticated zero-day exploits, but by preventable weaknesses in basic security configurations, credential management, and operational controls.
According to the advisory signed by Professor Obadare Adewale Peter, Chief Visionary Officer of Digital Encode Limited, attackers are increasingly exploiting misconfigured systems and publicly exposed assets, such as unsecured databases, open cloud storage buckets, leaked API keys, and critical servers exposed to the internet, many of which are easily discoverable through open repositories, cloud indexing tools, and even dark web marketplaces.
The advisory outlines critical areas of concern, including publicly accessible cloud storage exposing sensitive customer and operational data; hardcoded secrets in web and mobile applications, including API keys and tokens; leaked credentials in repositories and deployment artifacts; weak internal access controls and over-reliance on single authentication layers; exposure of administrative endpoints, API documentation, and development environments in production; uncontrolled use of Third-Party Hosting platforms such as Vercel, Netlify, and Render; poor token lifecycle management and weak authentication, inadequate vendor risk management and monitoring controls
Digital Encode noted that these vulnerabilities are widespread across organizations, particularly in financial institutions, payment service providers, Fintech companies and public sector platforms, where similar exposure patterns continue to recur.
Not a Technology Problem, But an Execution Gap
“Organizations affected in recent breaches were not compromised due to highly advanced attacks, but due to lapses in enforcing existing security controls, like, ensuring that no cloud resources linked to organizations whether AWS S3, Azure Blob, Google Cloud Storage, or Firebase allow anonymous access, Verify that no cloud credentials or API tokens are exposed in public or private repositories, container registries or deployed applications, and all external and internal APIs must enforce authentication and authorization controls at all times” Prof. Obadare stated.
The advisory stresses that most of these risks can be mitigated with readily available tools and best practices, underscoring a critical gap between security policy and implementation.
Urgent Actions Recommended
Digital Encode has called on organizations to act immediately by conducting a comprehensive audit of all internet-facing assets, including third-party systems; revoking and rotating all exposed or potentially compromised credentials including passwords, API keys, and access tokens; reviewing historical logs to assess the extent of any prior exploitation; engaging vendors to address third-party security exposures; fixing identified misconfigurations and validating remediation efforts; strengthening monitoring, logging, and threat detection systems; and documenting remediation steps and residual risks for governance and compliance.
The firm also emphasized the need for improved visibility into shadow IT and unauthorized deployments tied to employees’ accounts, which increasingly serve as entry points for attackers.
Call for Proactive Security Posture
Digital Encode reiterated its commitment to supporting organizations through enterprise-wide security assessments and independent validation of implemented controls.
“We strongly advise that this advisory be actioned without delay,” Prof Obadare warned, adding that proactive security hygiene, not reactive response, will determine resilience in Nigeria’s evolving threat landscape.
Digital Encode Limited is a trusted cybersecurity advisory firm specializing in information security, digital trust, and GRC services. The company supports organizations across sectors in strengthening their security posture and achieving regulatory compliance.
