Worry over cyberattacks on financial institutions – Daily Trust

Fresh considerations have emerged over cybersecurity threats dealing with Nigeria’s financial sector following a reported knowledge safety incident involving InvestNaija, warnings by First Bank in opposition to malicious cell purposes and alerts over the rising use of synthetic intelligence (AI) by fraudsters.

The developments have heightened considerations concerning the security of shoppers’ private and financial data as cybercriminals deploy more and more subtle strategies to deceive banking clients and achieve unauthorised entry to delicate knowledge.

In a notification to clients, InvestNaija disclosed that it obtained details about a possible knowledge safety incident on October 28, 2026, which can have resulted in unauthorised entry to a small portion of buyer knowledge.

The digital funding platform mentioned the affected knowledge represented lower than one per cent of its clients’ data.

It defined that uncommon visitors had been detected throughout its retail channels, prompting quick motion to deal with the menace, strengthen safety controls and shield clients’ data.

The firm mentioned it had reported the incident to legislation enforcement authorities and the related regulatory physique in keeping with the Nigeria Data Protection Act 2023 and different relevant regulatory necessities.

Although the incident was believed to have been contained, InvestNaija warned {that a} third celebration may need obtained some clients’ electronic mail addresses and different contact data.

It consequently suggested clients to stay vigilant in opposition to suspicious communications, stressing that it might by no means request passwords, fee particulars or one-time passwords (OTPs) by means of emails, textual content messages or phone calls.

The platform additionally assured clients that their investments remained protected and have been unaffected by the incident.

Meanwhile, First Bank has warned clients a couple of rising rip-off involving fraudulent pop-up messages that will seem on cell units by means of malicious purposes.

According to the financial institution, the messages are designed to trick customers into disclosing delicate banking data or authorising fraudulent transactions.

One instance includes a faux safety alert claiming that an account has irregular exercise and instructing the shopper to log in instantly, full a transaction or change a transaction password.

The financial institution cautioned clients in opposition to appearing on such messages, describing them as scams.

It suggested customers to obtain purposes solely from trusted sources, together with the Google Play Store and Apple App Store, and keep away from putting in software program by means of suspicious hyperlinks or pop-up commercials.

Customers have been additionally urged to evaluation put in purposes, replace their system working techniques and safety software program, and be cautious of unfamiliar purposes requesting pointless permissions, notably entry to Accessibility Services or permission to show over different purposes.

Separately, Lotus Bank has warned that fraudsters are more and more utilizing AI to create convincing emails, phone calls, textual content messages and movies that may be troublesome to differentiate from legit communications.

As a part of its Cybersecurity Awareness Month advisory, the financial institution urged clients to confirm uncommon fee requests by means of trusted different channels and keep away from clicking suspicious hyperlinks, opening surprising attachments or scanning unverified QR codes.

It additionally suggested clients by no means to reveal passwords, private identification numbers or OTPs, and to report suspicious exercise promptly.

Customers have been suggested to confirm surprising requests independently, shield their login credentials and report suspected fraud instantly to their financial institutions.

Experts weigh in

Meanwhile, consultants have mentioned Nigeria’s financial sector should urgently shift from reactive to proactive cybersecurity methods or threat catastrophic losses.

Professor Obadare Peter Adewale, Professor of Practice in Cybersecurity, Chief Visionary Officer of Digital Encode Ltd mentioned although the present menace and rising assaults aren’t peculiar to Nigeria, operators within the nation’s financial sector should outsmart the criminals.

Prof Obadare, who warned that synthetic intelligence would amplify present vulnerabilities, urged financial institutions to deal with elementary safety gaps.

“If you don’t spend the money on cybersecurity, you invariably will still spend the money. Before a breach, everybody will be calculating and arguing. Still, when there is a single attack, everybody starts to throw money at cybersecurity,” Obadare acknowledged.

The cybersecurity knowledgeable criticised what he described as a persistent reactive mindset of the numerous organizations within the nation.

Drawing consideration to often-overlooked vulnerabilities, Obadare revealed that inner threats pose higher dangers than exterior actors.

“Careless employees and malicious employees are even more than external factors,” he mentioned, urging organisations to deal with human elements alongside technological defences.

He mentioned know-how doesn’t create vulnerability — individuals do. True defence lies in steady consciousness, moral intelligence, and institutional self-discipline.

The professor cited current high-profile breaches at world know-how giants as an instance that even essentially the most subtle organisations aren’t immune.

He referenced a leak at NVIDIA, the world’s largest AI infrastructure supplier, brought on by improper patch administration, and a Microsoft Co-Pilot echo leak, in addition to safety failures at DeepSeek and ChatGPT.

“On the very day DeepSeek was launched, their entire database was exposed on the internet – chat histories, API keys, backend operational details, system logs, user prompts, everything,” Obadare disclosed, including that ChatGPT suffered a knowledge breach affecting over 1.2 million subscribers as a consequence of vulnerabilities in open-source elements.

He additionally criticised what he noticed as non-functional Security Operations Centres throughout the sector.

The knowledgeable emphasised that efficient cybersecurity requires balancing safety actions with sustainable operations. “Resilience is about balancing between protection activities and sustainable activities. When one cheats the other, there will be a problem,” he mentioned.

Olalekan Otufowora, one other knowledgeable, mentioned strong regulatory measures needs to be carried out by the CBN to strengthen the financial sector’s cyber defences.

Otufowora known as on the CBN to restructure its oversight method and consolidate supervision of cybersecurity, knowledge safety, and third-party administration inside a single supervisory construction to make sure consistency throughout all regulated entities.