Nigeria’s data protection regulator, the National Data Protection Commission, has raised concerns over what it described as coordinated cyberattacks aimed at the country’s financial systems and critical digital infrastructure.
In a data protection advisory issued on Thursday, the commission disclosed that its technical findings revealed the activities of “shadowy threat actors” targeting key national systems, increasing the risk of data breaches and service disruptions.
The NDPC noted that institutions providing banking services, payment platforms, telecommunications, cloud infrastructure, and public digital services are particularly vulnerable to these threats.
“The commission has identified coordinated malicious activities directed at critical sectors, posing significant risks to personal data and national digital assets,” the advisory stated.
The regulator urged organisations that handle personal data to immediately strengthen their security frameworks in line with the Nigeria Data Protection Act, 2023.
According to the commission, “data controllers and processors, including government agencies, must urgently enhance their technical and organisational measures to safeguard the privacy of Nigerians and other data subjects.”
As part of its recommendations, the NDPC called on organisations to appoint qualified Data Protection Officers, implement comprehensive privacy policies, and conduct Data Privacy Impact Assessments.
It also emphasised the need for stronger technological safeguards.
“Entities should deploy robust identity and access controls, adopt zero-trust architecture, and ensure continuous system updates to address vulnerabilities,” it said.
The commission further advised organisations to secure their cloud systems, application programming interfaces, databases, and access credentials, while adopting real-time monitoring and threat detection mechanisms.
“Regular vulnerability assessments, penetration testing, and reliable backup and recovery systems are essential to maintaining resilience against cyber threats,” the advisory added.
The warning comes amid ongoing investigations into a suspected data breach involving major financial service providers, including Remita Payment Services Limited and Sterling Bank.
The NDPC said the probe is focused on determining the extent of the breach, the categories of personal data affected, and the effectiveness of measures taken to mitigate potential harm.
Reaffirming its regulatory stance, the commission warned that organisations that fail to implement adequate data protection measures risk exposing millions of Nigerians to privacy violations and cyber risks.
