NDPC Raises Alarm Over Cyberattacks Targeting Nigeria’s Financial Systems

The Nigeria Data Protection Commission (NDPC) has sounded a critical alarm regarding a surge in coordinated cyberattacks aimed at Nigeria's vital financial systems and digital infrastructure. In a stern advisory, the commission highlighted the growing vulnerability of institutions underpinning banking, payments, telecommunications, and public services, warning of significant risks to data privacy and operational continuity.

“

The commission strongly advises that data controllers and processors (including MDAs) are to urgently step up their technical and organisational measures to ensure the privacy of all Nigerians and other data subjects in line with the Nigeria Protection Act, 2023 (NDP Act).

This proactive warning underscores the increasing sophistication of "shadowy threat actors" and the imperative for Nigerian organizations to bolster their defenses. The NDPC's directive emphasizes the urgent need for enhanced technical and organizational measures, aligning with the Nigeria Data Protection Act of 2023. This includes appointing qualified Data Protection Officers, establishing comprehensive privacy policies, and conducting thorough Data Privacy Impact Assessments.

“

Organisations are expected to deploy robust identity and access controls, adopt zero trust architecture, and ensure continuous patch management to address system vulnerabilities.

The commission's guidance extends to implementing robust security architectures, such as zero-trust models, multi-factor authentication, and continuous patch management. The focus on securing cloud infrastructure, APIs, and databases reflects the evolving threat landscape. This advisory is particularly timely, coming amidst an ongoing investigation into alleged data breaches involving prominent financial entities, demonstrating the NDPC's commitment to safeguarding sensitive Nigerian data and ensuring accountability within the digital ecosystem.

“

Entities should conduct vulnerability assessment and penetration testing on critical systems and maintain regular backup, recovery, and resilience testing.