Nigeria is the second most targeted country in Africa for cyber attacks. Most business owners are still not taking it seriously

In June 2026, organisations across Nigeria faced an average of 4,361 attempted cyberattacks every single week. That figure, published by Check Point Software, places Nigeria second in Africa for cyber threats, behind only South Africa. In the first half of this year alone, Kaspersky’s threat intelligence recorded 1.6 million web-based attack attempts targeting Nigerian internet users, with 18.4 per cent of Nigerian internet users encountering a web-based cyber threat during that six-month period. In the first quarter of 2026, approximately 281,500 Nigerian user accounts were compromised and are currently believed to be circulating on dark web marketplaces, available to anyone willing to pay for them.

These are not numbers from a distant economy with different problems. They describe the digital environment in which every Nigerian business, large or small, is operating right now.

And yet the conversation inside most Nigerian boardrooms and business offices remains remarkably calm. Cybersecurity is discussed when a breach makes the news. It attracts attention when a bank or a fintech company discloses an incident. Then the news cycle moves on, the conversation quiets, and the assumption reasserts itself that the problem belongs to someone else, to larger institutions with more data, more exposure, and therefore more reason to worry. That assumption is no longer defensible, and the data makes clear why.

Here is the detail that deserves the most attention and receives the least. Reported fraud incidents in Nigeria have actually decreased by nearly 46 per cent over the past four years. On the surface, that sounds like progress. The reality is more uncomfortable. Financial losses from cybercrime have continued to rise over the same period. Fewer attacks are getting through, but the ones that do are extracting significantly more value than before. Cybercriminals are not becoming less active. They are becoming more selective, more patient, and more precise. The era of the mass phishing email sent to millions of random addresses is giving way to targeted operations designed around specific organisations, specific individuals, and specific vulnerabilities identified through careful research. The attack that arrives today is more likely to succeed than the one that arrived three years ago, even if it arrives less frequently.

The nature of how these attacks operate has shifted in ways that make traditional defences insufficient. Kaspersky’s research shows that password-stealer detections in Nigeria increased by 26 per cent in 2025, while spyware attacks rose 14 per cent. This reflects a deliberate strategic shift by criminal actors away from disrupting systems and toward quietly harvesting credentials, identities, and financial access. An organisation that has never experienced a visible breach may nonetheless have had staff credentials stolen months ago, sitting undetected in the hands of someone waiting for the right moment to use them. The absence of a visible incident is not evidence of safety. It may simply be evidence that the attacker has not yet decided to act on what they already have.

The Sterling Bank incident disclosed earlier this year illustrates how this works in practice. A threat actor exploited a publicly disclosed vulnerability in a web application framework to gain unauthorised remote code execution access to the bank’s pilot infrastructure. The Nigeria Data Protection Commission subsequently opened an investigation into whether customer data linked to both Remita and Sterling Bank had been exposed. These are not small or unsophisticated institutions. They are organisations with dedicated technology teams, compliance frameworks, and security budgets. The fact that they remain exposed to incidents of this kind is not an indictment of their specific practices. It is a description of the environment every Nigerian business now operates in, one where the sophistication of the threat has outpaced the speed at which most organisations have updated their defences.

For larger corporations, the risk surface has expanded in ways that were not fully anticipated even five years ago. The shift toward remote and hybrid working, the integration of cloud-based platforms, and the growing dependence on third-party software vendors and digital supply chains have each introduced new points of exposure that traditional perimeter-based security was not designed to address. Deloitte’s Nigeria Cybersecurity Outlook for 2026 notes that organisations face significant inherited risks from their digital supply chains, with weaknesses in connected vendors, software platforms, and cloud services creating attack vectors that sit outside the direct control of the organisations most exposed to them. A company can have exemplary internal security practices and still be compromised through a vulnerability in a software tool its finance team uses daily.

For smaller businesses, the challenge is different in character but equal in urgency. The assumption that cybercriminals target large organisations because large organisations hold more valuable data is outdated. Small businesses are increasingly attractive targets precisely because their defences are weaker, their recovery capacity is lower, and the probability of a successful attack is higher. A criminal who can extract two million naira from a small business with minimal effort may find that more efficient than mounting a complex operation against a heavily defended corporate target. The 80 million Nigerian data records currently estimated to be circulating on dark web marketplaces did not all come from large institutions. Many came from small businesses, service providers, and individual professionals whose data handling practices were never designed with this threat environment in mind.

The response to all of this cannot be paralysis, and it cannot be the comfortable assumption that because nothing has visibly gone wrong yet, nothing is likely to. Both of those responses leave a business exactly where it currently is, exposed and unaware of the degree to which it is exposed.

So here is the challenge worth taking seriously before the end of this week. Think about who in your organisation currently has access to your financial systems, your customer data, and your operational platforms. Think about when those access credentials were last reviewed, updated, or audited. Think about whether your staff would recognise a targeted phishing attempt designed specifically around your business, your suppliers, and your internal language. And think about whether your organisation has a documented plan for what happens in the first twenty-four hours after a breach is discovered.

If any of those questions produces a moment of uncertainty, that uncertainty is the answer. And it is worth acting on before someone else acts on it first.