Cyberattack Claims Raise Fresh Security Concerns for Nigeria’s Fintech Sector

Unverified Cyberattack Claims Raise Fresh Security Questions for Nigeria’s Fintech Sector

Reports of cyberattacks targeting Nigerian fintech companies have sparked fresh concerns about cybersecurity, customer protection and the way financial technology firms share information about threats.

The reports, highlighted by BusinessDay in November 2026, allege that several Nigerian fintech companies have faced cyberattacks since October. However, it is important to distinguish between what has been reported and what has been independently confirmed: the identities of several companies allegedly affected and the financial losses attributed to the attacks have not been independently verified.

What has been reported?

According to BusinessDay, the allegations were published by Olumuyiwa Olowogboyega, publisher of Notadeepdive. The report claimed that multiple fintech companies had been targeted, with sources alleging losses ranging from hundreds of thousands of dollars to billions of naira.

One company identified in connection with the reports is Lendsqr, a Nigerian lending-as-a-service company. BusinessDay reported that Lendsqr detected attempts to breach its systems on October 30 after conducting a security review prompted by attacks reportedly affecting other financial technology businesses.

The review reportedly uncovered more than 800 vulnerabilities in Lendsqr's code, ranging from minor weaknesses to serious security concerns. The company subsequently worked to address the vulnerabilities.

Lendsqr has also published its own account of the wider threat environment. The company said Nigerian banks, fintechs and lenders were being targeted in a sustained wave of attacks and urged financial institutions to take immediate security measures.

Among the attack patterns Lendsqr described were the use of leaked developer tokens, phishing through compromised email accounts, attempts to guess administrator passwords, automated probing of APIs and attempts to locate exposed files containing cloud credentials.

The company also said it had detected and blocked hundreds of attempts to access sensitive files across its infrastructure.

However, these reports should not automatically be interpreted as proof that every alleged attack or financial loss occurred exactly as described. BusinessDay specifically noted that the reported losses could not be independently verified and that the affected companies were not identified.

Why customers are worried

For fintech customers, the biggest concern is not simply whether a company experienced an attempted cyberattack. Financial technology platforms handle highly sensitive information and transactions, meaning a successful breach could potentially expose personal information, account credentials or financial assets.

Customers may also worry about what happens when a company detects suspicious activity but does not immediately make a public announcement.

There is an important distinction here. A cyberattack does not automatically mean that customers' personal information has been compromised. Under Nigeria's data protection framework, companies have specific obligations when a personal-data breach creates risks to individuals.

The Nigeria Data Protection Act 2023 requires data controllers to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a personal-data breach that is likely to create a risk to individuals' rights and freedoms. Where a breach presents a high risk to affected individuals, those individuals must also be informed.

That means the absence of a public statement alone does not prove that a company has broken the law. An attempted intrusion into internal systems, for example, may not involve customer data at all.

This distinction is particularly important when dealing with claims circulating online. In April 2026, the Nigeria Data Protection Commission investigated alleged breaches involving Remita and Sterling Bank after threat actors claimed to have accessed sensitive information. The commission said its investigation would determine the scope of the alleged incident and whether personal data had actually been compromised.

The bigger lesson for fintech startups

The latest reports point to a broader issue: cybersecurity cannot be treated as an individual-company problem.

Fintech companies operate in an interconnected ecosystem. They rely on payment processors, banks, cloud providers, software developers, APIs, contractors and other technology partners. A compromised credential or vulnerable third-party system can therefore create risks that extend beyond one company.

This makes threat intelligence sharing especially important.

Lendsqr has argued that companies should share information about attacks rather than remain silent. Its security advisory encouraged organisations to rotate API keys and tokens, enable two-factor authentication, remove unnecessary access, secure administrative systems and continuously scan their infrastructure.

Nigeria's fintech industry has previously explored collective approaches to fraud prevention. BusinessDay noted that Project Radar, proposed in 2023 as a shared registry for identifying fraudsters, was later renamed Reporta. Questions remain about how effective such collaborative systems are today.

The challenge is finding a balance between information sharing and customer privacy. Companies need to exchange enough technical information to help others defend themselves without unnecessarily exposing customers' personal information.

What startups should learn

For technology startups, the recent reports offer several practical lessons.

First, security needs to be built into the business from the beginning rather than treated as an expense to address after an incident.

Second, companies need to know exactly who has access to their systems. Old developer credentials, API keys and accounts belonging to former employees or contractors can become significant security risks if they are not regularly reviewed and revoked.

Third, employees need continuous cybersecurity training. Phishing, stolen credentials and social engineering remain important attack routes because even sophisticated systems can be undermined when attackers obtain legitimate login information.

Finally, companies need clear incident-response plans. When suspicious activity is detected, teams should know who investigates it, who contacts regulators, how customers will be protected and when information should be shared with other organisations.

The current cyberattack claims remain partly unverified, and that fact should not be overlooked. But uncertainty about individual incidents does not make the underlying cybersecurity concern less important.

For Nigeria's rapidly growing fintech sector, the bigger lesson is that keeping customers safe requires more than protecting individual platforms. Companies need stronger security practices, faster threat intelligence sharing and clearer communication when genuine breaches occur.

As more Nigerians depend on digital platforms for payments, transfers, savings and other financial services, trust will increasingly depend not only on how quickly fintech companies innovate, but also on how responsibly they protect the systems and information entrusted to them.