| By: Francis Onyemachi
The expansion of Nigeria’s digital economy is gathering pace, with fintech companies driving financial inclusion, Artificial Intelligence being adopted across sectors, public and private services moving online, while businesses continue to rely on cloud computing.
These developments, which continue to foster digital transformation, have also widened the country’s cyber threat ecosystem.
Ransomware and identity theft have been identified as some of the biggest threats confronting organisations today.
According to a report cited by Nigeria Data Protection Commission chairman, Vincent Olatunji, ransomware attacks in Nigeria account for about 35% of total financial losses while identity theft and data breaches contribute roughly to overall digital economy losses, as the country accounts for 45% of reported cyberattacks across the continent.
Experts, however, said these attacks have escalated from isolated incidents into organised criminal operations capable of crippling businesses, organisations and financial institutions.
Bright Anyanwu, senior compliance manager & MLRO, West, Central & East Africa at Yellow Card, said the surge being witnessed in the sector is not accidental, describing it as a collision of three forces.
Nigeria’s Digital Economy Expanding Faster than its Security Architecture
Anyanwu stressed that Nigeria’s digital economy has expanded faster than its security architecture, citing 45% of reported cybercrime incidents on the continent
“Nigeria now accounts for roughly 45 per cent of reported cybercrime incidents on the continent, with attack patterns spanning phishing, ransomware, business email compromise, and identity theft targeting financial institutions, telecom platforms, and public systems. When you digitise onboarding, payments, lending, and government services at this pace, every new endpoint is a new attack surface,” he said
Stolen Identity Data
The Compliance Manager explained that stolen Nigerian identity data has become a commodity with global liquidity.
According to him, dark web actors continue to sell stolen private databases, credentials and telecom records, citing claims of over 60 million traded records, alongside about 130,000 exposed healthcare records.
“Threat intelligence assessments have documented dark web actors actively selling Nigerian banking databases, stolen credentials, and telecom records, with claims of over 60 million records being traded, alongside exposed healthcare data covering roughly 130,000 patient entries.”
Anyanwu noted that identity theft stops being a specialist crime to become industrialised once identity data remains cheap and abundant.
“On this note, criminals no longer need to break into your systems; they simply log in with credentials purchased for a few dollars.”
Changing Business Model
In this part, the expert stated that ransomware itself has changed its business model. Identity misuse is now involved in over 80% of ransomware operations, while roughly three-quarters of attacks include data theft rather than encryption alone.
In his words, ransomware and identity theft are two stages of the same value chain, adding that both are no longer separate threats.
He pointed to fintech and financial services, telecoms, healthcare and government agencies as the most vulnerable sectors in Nigeria today.
According to him,
“The most vulnerable sectors in Nigeria today are financial services and fintech, because that is where the money and the KYC data sit; telecoms, because SIM infrastructure underpins authentication for almost everything else; healthcare, because patient records are rich, poorly protected, and rarely monitored; and government agencies, where legacy systems hold enormous citizen datasets, including national identity records, with uneven security controls,” he said.
He also described Small and Medium-sized Enterprises (SMEs) as a silent casualty that sits in the supply chains of larger institutions, but increasingly serves as the entry point rather than the target.
How Digital Transformation Changed the Economics of Cyberattacks
For Abraham Udu, director of programs at the Association of Certified Financial Crimes Specialists (ACFCS) West Africa, digital transformation has significantly changed the economics of attack, noting that a criminal needed technical skill to breach a Nigerian bank five years ago, while attack chains have become modular and rentable today, with concerns on AI-enabled social engineering rising in 2026.
“Today, the attack chain is modular and rentable. Ransomware-as-a-service, phishing kits, and initial access brokers mean that a threat actor in Lagos or Lagos Island can assemble a sophisticated campaign from off-the-shelf components.
“The methods that concern me most in 2026 are, first, AI-enabled social engineering. AI-generated phishing lures have eliminated the traditional red flags, such as poor grammar and are lifting click-through rates dramatically, and a growing share of attacks now arrive through SMS and messaging apps, where mobile users are far more likely to click,” Udu said.
Udu said that this matters enormously in Nigeria as a mobile-first market where deepfake voice and video are also now being used to impersonate executives in payment authorisation fraud, which puts every finance and treasury function on notice.
Udu also cited identity-based intrusion, with credential theft rising 160% in 2025, with 1.8 billion logins stolen from infected devices globally.
According to him, attackers increasingly bypass the perimeter entirely by abusing legitimate credentials, session cookies, and SIM swaps.
The program lead also highlighted supply chain and third-party compromise, where attackers breach one vendor or managed service provider and inherit access to dozens of institutions downstream.
He added that multi-extortion ransomware has changed the nature of attacks, noting that,
“The threat is no longer ‘we encrypted your data’ but ‘we will publish your customers’ KYC files and report you to your regulator’. For a licensed financial institution, that reputational and regulatory extortion is often more coercive than the encryption itself.”
From his point in the virtual asset sector, he said the laundering side of this economy is witnessing in real time.
He noted that blockchain analytics has actually made crypto one of the more traceable rails for ransomware proceeds, which is why compliant, licensed VASPs are increasingly part of the solution.
Biggest Gaps Despite Continued Cybersecurity Investment
The experts said the most successful attacks in Nigeria do not defeat technology alone but also exploit weaknesses in governance, revealing that organisations keep buying tools while the fundamentals remain broken.
They identified four persistent gaps, including people, process, technology and governance.
According to Anyanwu, security awareness is still treated as an annual compliance video rather than continuous behavioural training.
He said:
“The human is the primary attack surface, yet receives the smallest share of the security budget. There is also a serious skills shortage, particularly outside Lagos and Abuja, that leaves capable tools running without capable operators.”
Speaking on the issue of process, Anyanwu explained that incident response plans exist on paper but are never tested.
In his words, very few Nigerian institutions run genuine tabletop exercises for a ransomware scenario, leaving the first 48 hours of an attack chaotic.
“So when an attack lands, the first 48 hours are chaos, and it is in those 48 hours that most of the damage crystallises. Backup discipline is another quiet failure. Backups are compromised in nearly four out of ten ransomware incidents, usually because they were connected to the same network and protected by the same credentials attacker had already compromised.”
In the area of technology, Udu explained that the gap is not the absence of tools but the lack of identity-centric architecture.
He noted that over 80% of ransomware operations rely on stolen credentials. Multi-factor authentication, privileged access management, and continuous monitoring of identity behaviour are not optional extras. They are the control environment.
Meanwhile, governance was identified as the deepest gap. The expert lamented that cybersecurity is still reported to the board as an IT metric rather than owned as an enterprise financial crime and operational resilience risk.
“Boards should be interrogating cyber risk with the same rigour they apply to credit risk and AML risk, with defined risk appetite, residual risk measurement, and clear accountability. Under the Nigeria Data Protection Act 2023 and the GAID 2025 framework, the NDPC now requires breach reporting within 72 hours and mandatory audits for data controllers, yet many institutions could not meet a 72-hour notification obligation today because they lack the detection capability to know they have been breached at all.” Udu added.
Immediate Steps for Businesses and Individuals
According to the experts, the next 12 months will reward institutions that move from reactive detection to preventive, intelligence-led resilience.
Cybersecurity is no longer an IT expense. In 2026, it is the licence to operate in Nigeria’s digital economy.
The experts urged businesses to make identity the new perimeter by enforcing phishing-resistant multi-factor authentication across critical systems, maintaining immutable offline-tested backups, rehearsing restoration, and conducting a full ransomware tabletop exercise.
This should involve the board, legal, compliance, and communications within the next quarter, insisting that the middle of a crisis is the wrong time to learn an incident response plan.
“Map and assess third-party and vendor risk, since your resilience is only as strong as your weakest supplier. And integrate cyber threat intelligence with your financial crime function, because ransomware, identity theft, fraud, and money laundering are now one continuous chain, and institutions that still manage them in silos will always be a step behind,” Anyanwu stated.
For regulators, a coordinated national framework for breach notification, a funded cross-sector threat intelligence sharing mechanism anchored by ngCERT, and consistent enforcement were identified as key updates that would change behaviour faster than any new rule.
He tasked regulators to also deepen public-private partnership with licensed VASPs and blockchain analytics providers, because tracing and freezing ransomware proceeds is one of the few points in the attack chain where the criminal is genuinely exposed.
He encouraged individuals to use strong, unique passwords with a password manager, enable two-factor authentication on banking, email, and SIM services, treat every unsolicited link, call, or ‘urgent’ payment request as hostile until verified through a separate channel, and guard NIN, BVN, and identity documents as carefully as cash.
On the role of AI, he encouraged faster adoption in security operations to stay ahead of attackers, noting that timely deployment can reduce breach response times by around 80 days and save close to $2 million per incident on average.
