Nigeria’s Systemic Cyber Attacks Demand Coordination

Recent disclosures and ongoing investigations suggest that entities across sectors have been targeted, including a state government, key financial institutions, and federal agencies such as the Industrial Training Fund, alongside healthcare-related platforms linked to national institutions. This breadth reinforces a crucial point. Nigeria is not dealing with a single breach. It is confronting a stress test of its digital resilience.

In this context, the role of the Nigeria Data Protection Commission, the Central Bank of Nigeria, the National Information Technology Development Agency, and other relevant regulatory bodies becomes even more consequential. Regulatory oversight remains essential, but the immediate priority must shift from enforcement to coordination. Moments of systemic vulnerability require regulators to act as conveners, not just enforcers.

There is an old instinct in institutional governance, familiar across many sectors, that reaches for the penalty clause the moment something goes wrong. It is an understandable reflex. Regulators exist to enforce standards, and where those standards appear to have been breached, the machinery of sanction tends to warm up quickly. But there are moments when that reflex, however well-intentioned, risks doing more damage than the original problem. Nigeria is in one of those moments right now.

The question is not whether organisations should be held accountable. It is whether this is the right moment to prioritise sanctions over stabilisation. Premature emphasis on fines risks creating a defensive posture among operators, discouraging transparency at a time when information sharing is critical to containment and recovery.

The more important question for regulators is not only who failed to protect data, but what systemic conditions made so many organisations vulnerable at the same time, and what can be done collectively to address those conditions before the next wave arrives.

Consequently, a more strategic approach would focus on building a collaborative defence architecture. Regulators must work closely with financial institutions, fintech operators, telecom providers, and government agencies to establish a real-time threat intelligence framework. Cyber incidents thrive in silos. Effective defence requires visibility across systems.

There is also a clear need to accelerate the development of a national incident response protocol. This should define how organisations report breaches, how information is shared, and how coordinated responses are executed. At present, fragmentation remains a key vulnerability.

Capacity building must also move to the forefront. Nigeria’s cybersecurity talent pool, while growing, remains under pressure, particularly in the face of increasing global demand. Structured investment in training, certification, and retention is essential. Public private partnerships can play a critical role in scaling this capacity quickly.

Equally important is the need to strengthen baseline security standards across sectors. Many organisations, particularly within the public sector, operate legacy systems that were not designed for today’s threat environment. Regulatory guidance should therefore prioritise minimum security benchmarks, continuous monitoring requirements, and regular vulnerability assessments.

There is also a communication challenge that must be addressed. Selective disclosure or partial framing of incidents can create confusion and erode trust. In situations where multiple entities are affected, clarity becomes a strategic necessity. Stakeholders must have a clear understanding of the scale and nature of the threat to respond effectively.

Nigeria's digital economy is not fragile. It is, in fact, one of the most dynamic and innovative on the continent. But dynamism without the institutional architecture to protect it is a vulnerability in itself. The regulators who oversee this ecosystem have a rare opportunity, in this moment of shared exposure, to demonstrate that Nigerian governance can be both rigorous and intelligent. That it can distinguish between punishment and protection. And that when the country faces a threat of this nature and scale, the first instinct of its institutions is to stand together rather than to reach for the penalty clause.

Ultimately, cybersecurity is not just a compliance issue. It is a national security concern, an economic stability issue, and a trust imperative. The current wave of incidents presents an opportunity to rethink how Nigeria approaches digital risk. The focus must be clear. Chase away the hawk first. Then strengthen the coop.