A wave of sophisticated ransomware attacks has targeted Nigerian government agencies and top-tier financial institutions over the past three weeks, exposing deep vulnerabilities in the country’s rapidly expanding digital economy.
Reports from the National Information Technology Development Agency and the Corporate Affairs Commission confirm that coordinated threat actors breached critical infrastructure, causing service disruptions and the suspected exfiltration of sensitive data. In response, the Corporate Affairs Commission temporarily shut down its company registration portal, while the Nigeria Data Protection Commission launched an investigation.
The incidents highlight a shift in Nigeria’s cybersecurity threats from opportunistic fraud to large-scale institutional extortion. Concerns are mounting over the country’s digital resilience, particularly as preparations begin for the 2027 general elections, with the Independent National Electoral Commission seen as a potential target.
Nigerian organizations are facing an estimated 4,700 cyberattacks weekly, underscoring the intensity of the threat. Earlier this year, cybersecurity firm Check Point warned of a surge in attacks on African banks, noting a 115% increase in global financial sector attacks — from 864 incidents in 2024 to 1,858 in 2025.
Last week, reports emerged that about 25 million documents — roughly 750GB of data — were exfiltrated from the Corporate Affairs Commission. The breach has been linked to a threat actor known as ByteToBreach, which has been active since mid-2025 and is known for exploiting internet-facing systems to steal and trade sensitive data.
The group reportedly documented each phase of the attack, from initial access to full system control and data extraction. While about 25% of the files were described as routine corporate signatures, more than 15 million documents contain sensitive corporate and identity information.
The attack is the third attributed to ByteToBreach in recent weeks, following breaches involving Sterling Bank and the Remita payment platform. A cybersecurity expert familiar with government systems said the group has evolved into a significant threat to Nigeria’s economic security.
The expert noted that a separate breach involving Remita may have stemmed from a misconfigured Amazon S3 storage system, exposing approximately three terabytes of data — a failure likely tied to human error rather than advanced hacking techniques.
The threat is not limited to Nigeria. In South Africa, Standard Bank and its insurer Liberty reported unauthorized access to internal systems, exposing limited customer data, including account details and identification numbers.
Cybersecurity experts warn the breach of the Corporate Affairs Commission database carries serious implications. The database contains legal and ownership records for businesses across Nigeria, meaning the leak could expose beneficial ownership structures and enable fraud, identity theft and corporate espionage.
The incident also undermines ongoing efforts by Nigerian authorities to improve transparency and combat financial crimes, including recent actions to identify fraudulent companies.
Experts say the breach reflects systemic weaknesses in Nigeria’s digital infrastructure and underscores the urgent need to strengthen cybersecurity frameworks, particularly as threat actors expand their operations globally.
