Unverified fintech cyberattack reports highlight gaps in Nigeria’s threat-sharing framework

Log in or create a free account to get started.

Read History Go to My Account Log Out Enhanced by Google Technology Unverified fintech cyberattack reports highlight gaps in Nigeria’s threat-sharing framework Reports of cyberattacks targeting several Nigerian fintech companies have raised concerns about the industry’s cybersecurity preparedness and limited collaboration in

Listen to this article Share Reports of cyberattacks targeting several Nigerian fintech companies have raised concerns about the industry’s cybersecurity preparedness and limited collaboration in sharing intelligence on emerging digital threats.

The claims, published by Olumuyiwa Olowogboyega, publisher of Notadeepdive, allege that multiple fintech companies have suffered attacks since October, 2026, with some reportedly losing billions of naira. However, the companies involved were not identified, and the reported financial losses have not been independently verified.

According to the account, Lendsqr, a Nigerian lending-as-a-service startup founded by Adedeji Olowe, detected attempts to breach its systems on October 30, following a security review prompted by earlier attacks on other fintech businesses.

The review reportedly uncovered more than 800 vulnerabilities in its code, ranging from minor weaknesses to serious security concerns. The company subsequently spent three weeks fixing the identified problems.

The attackers allegedly used stolen developer tokens, attempted to guess employees’ passwords and sent fake payment notifications to test the company’s systems. In one instance, an attacker reportedly used a borrower’s genuine password but was stopped by Lendsqr’s device verification controls.

Lendsqr reportedly suffered no financial loss or customer data compromise from the attempts.

However, Olowogboyega cited sources familiar with other incidents who alleged that one major fintech lost slightly more than N3.5 billion, another lost about N1 billion, while a third incurred approximately $300,000 in costs associated with a month of attacks.

The allegations could not be independently verified, and the identities of the affected companies remain undisclosed.

Beyond the reported financial losses, the incidents highlight the difficulty of containing cyber threats in an interconnected fintech ecosystem where developers, software vendors and service providers may have access to multiple companies’ systems.

Olowogboyega said Lendsqr’s experience exposed the risks associated with compromised developer credentials, prompting the company to contact developers who had worked with it over six years and request that they revoke their access tokens and examine their devices.

The situation reinforces the importance of sharing actionable threat intelligence across the industry, particularly where attackers may exploit credentials or vulnerabilities that other companies have not yet identified.

Nigeria’s fintech industry previously explored collective approaches to combating digital fraud through Project Radar, a shared registry proposed in March 2023 to help companies identify fraudsters and exchange information. The initiative was renamed Reporta in 2024, although its current operational effectiveness remains unclear.

However, concerns about customer privacy and the legality of sharing personal information have complicated such collaboration.

The Nigeria Data Protection Commission (NDPC) could help address this challenge by clarifying how fintech companies can lawfully exchange cybersecurity intelligence without violating data protection obligations.

The reported incidents have also drawn attention to the responsibilities of fintech companies under the Nigeria Data Protection Act 2023.

Section 40 requires data controllers to notify the NDPC within 72 hours of becoming aware of a personal data breach likely to result in a risk to individuals’ rights and freedoms.

Where a breach is likely to create a high risk to affected individuals, companies must also communicate the incident to them immediately, explaining its nature and measures they can take to mitigate potential harm.

“The law does not require companies to issue public statements after every cyberattack. An attack on internal infrastructure, source code or payment systems does not automatically constitute a reportable personal data breach if customers’ personal information is not compromised,” an official from NDPC told BusinessDay.

Olowogboyega’s account said people familiar with the incidents told him that the reported attacks had not been reported to the NDPC. However, the commission has not publicly confirmed the incidents or established whether any involved personal data breaches requiring notification.

The distinction is important because the absence of a public announcement does not establish that a company violated its statutory reporting obligations.

Ultimately, the allegations raise questions about whether Nigeria’s fintech companies have effective mechanisms for sharing information about cyber threats and coordinating responses.

Without stronger collaboration, companies could continue facing attacks using vulnerabilities and compromised credentials that other players in the industry have already encountered.

Royal Ibeh is a senior journalist with years of experience reporting on Nigeria’s technology and health sectors. She currently covers the Technology and Health beats for BusinessDay newspaper, where she writes in-depth stories on digital innovation, telecom infrastructure, healthcare systems, and public health policies.