Fintech Cyberattack Reports Raise Fresh Trust Questions in Nigeria

Nigeria’s growing fintech industry is facing renewed questions about cybersecurity and customer trust following reports of alleged cyberattacks targeting several financial technology companies.

A report published by BusinessDay on November 7, 2026, said multiple Nigerian fintech companies had reportedly experienced cyberattacks since October. The allegations were published by Olumuyiwa Olowogboyega, publisher of Notadeepdive. However, the companies involved were not identified, and the reported financial losses have not been independently verified.

According to the report, Nigerian fintech company Lendsqr detected attempts to breach its systems on October 30 after conducting a security review. The review reportedly uncovered more than 800 vulnerabilities in its code, ranging from minor weaknesses to serious security concerns. The company subsequently worked to address the identified problems.

The reported attackers allegedly attempted to use stolen developer tokens, guess employees’ passwords and send fake payment notifications. In one reported incident, an attacker allegedly used a borrower’s genuine password but was stopped by the company’s device verification security controls.

Importantly, Lendsqr reportedly suffered no financial loss or customer data compromise from these attempts.

Other alleged incidents involved substantial financial losses, including claims that one fintech company lost more than N3.5 billion, another lost approximately N1 billion, while another reportedly spent about $300,000 dealing with attacks. These figures remain unverified, and the identities of the companies have not been disclosed.

The reports highlight an important issue in Nigeria’s rapidly expanding fintech sector: trust. Millions of Nigerians depend on digital financial platforms to transfer money, receive payments, save funds and manage everyday transactions. Any security weakness can create fear among customers and damage confidence in digital financial services.

For fintech companies, cybersecurity must go beyond protecting their applications. Businesses need strong password policies, multi-factor authentication, regular security testing, employee training and proper monitoring of third-party access. Companies should also cooperate by sharing relevant threat information so that attacks affecting one organisation can help others strengthen their defences.

The Nigeria Data Protection Act 2023 also places responsibilities on organisations handling personal information. BusinessDay reported that Section 40 requires data controllers to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a personal data breach likely to create risks to individuals’ rights and freedoms. Affected individuals must also be informed immediately where the breach creates a high risk to them.

Consumers also have a role to play in protecting themselves. They should avoid sharing passwords, PINs and one-time passwords with anyone, use strong and unique passwords, enable available security features and regularly check transaction histories. They should also be careful with suspicious links, messages and calls claiming to come from financial institutions.

Customers should not panic or assume that every fintech platform has been compromised. The reported allegations have not established that all Nigerian fintech companies were attacked or that customer funds and personal information were stolen.

Ultimately, Nigeria’s fintech industry can only maintain public confidence through transparency, strong security systems and responsible communication. As digital payments continue to grow, protecting customers must remain just as important as developing new financial technologies.