Worry over cyberattacks on financial institutions – Daily Trust

Fresh issues have emerged over cybersecurity threats dealing with Nigeria’s financial sector following a reported knowledge safety incident involving InvestNaija, warnings by First Bank in opposition to malicious cellular purposes and alerts over the rising use of synthetic intelligence (AI) by fraudsters.

The developments have heightened issues concerning the security of consumers’ private and financial data as cybercriminals deploy more and more refined strategies to deceive banking prospects and achieve unauthorised entry to delicate knowledge.

In a notification to prospects, InvestNaija disclosed that it acquired details about a possible knowledge safety incident on October 28, 2026, which can have resulted in unauthorised entry to a small portion of buyer knowledge.

The digital funding platform mentioned the affected knowledge represented lower than one per cent of its prospects’ data.

It defined that uncommon site visitors had been detected throughout its retail channels, prompting speedy motion to deal with the menace, strengthen safety controls and shield prospects’ data.

The firm mentioned it had reported the incident to regulation enforcement authorities and the related regulatory physique consistent with the Nigeria Data Protection Act 2023 and different relevant regulatory necessities.

Although the incident was believed to have been contained, InvestNaija warned {that a} third get together may need obtained some prospects’ e mail addresses and different contact data.

It consequently suggested prospects to stay vigilant in opposition to suspicious communications, stressing that it will by no means request passwords, fee particulars or one-time passwords (OTPs) by means of emails, textual content messages or phone calls.

The platform additionally assured prospects that their investments remained secure and had been unaffected by the incident.

Meanwhile, First Bank has warned prospects a few rising rip-off involving fraudulent pop-up messages which will seem on cellular gadgets by means of malicious purposes.

According to the financial institution, the messages are designed to trick customers into disclosing delicate banking data or authorising fraudulent transactions.

One instance entails a faux safety alert claiming that an account has irregular exercise and instructing the shopper to log in instantly, full a transaction or change a transaction password.

The financial institution cautioned prospects in opposition to appearing on such messages, describing them as scams.

It suggested customers to obtain purposes solely from trusted sources, together with the Google Play Store and Apple App Store, and keep away from putting in software program by means of suspicious hyperlinks or pop-up commercials.

Customers had been additionally urged to evaluation put in purposes, replace their gadget working techniques and safety software program, and be cautious of unfamiliar purposes requesting pointless permissions, notably entry to Accessibility Services or permission to show over different purposes.

Separately, Lotus Bank has warned that fraudsters are more and more utilizing AI to create convincing emails, phone calls, textual content messages and movies that may be troublesome to tell apart from reliable communications.

As a part of its Cybersecurity Awareness Month advisory, the financial institution urged prospects to confirm uncommon fee requests by means of trusted various channels and keep away from clicking suspicious hyperlinks, opening surprising attachments or scanning unverified QR codes.

It additionally suggested prospects by no means to reveal passwords, private identification numbers or OTPs, and to report suspicious exercise promptly.

Customers have been suggested to confirm surprising requests independently, shield their login credentials and report suspected fraud instantly to their financial institutions.

Experts weigh in

Meanwhile, specialists have mentioned Nigeria’s financial sector should urgently shift from reactive to proactive cybersecurity methods or danger catastrophic losses.

Professor Obadare Peter Adewale, Professor of Practice in Cybersecurity, Chief Visionary Officer of Digital Encode Ltd mentioned although the present menace and rising assaults aren’t peculiar to Nigeria, operators within the nation’s financial sector should outsmart the criminals.

Prof Obadare, who warned that synthetic intelligence would amplify present vulnerabilities, urged financial institutions to deal with basic safety gaps.

“If you don’t spend the money on cybersecurity, you invariably will still spend the money. Before a breach, everybody will be calculating and arguing. Still, when there is a single attack, everybody starts to throw money at cybersecurity,” Obadare said.

The cybersecurity skilled criticised what he described as a persistent reactive mindset of the numerous organizations within the nation.

Drawing consideration to often-overlooked vulnerabilities, Obadare revealed that inner threats pose larger dangers than exterior actors.

“Careless employees and malicious employees are even more than external factors,” he mentioned, urging organisations to deal with human components alongside technological defences.

He mentioned expertise doesn’t create vulnerability — folks do. True defence lies in steady consciousness, moral intelligence, and institutional self-discipline.

The professor cited current high-profile breaches at world expertise giants for example that even essentially the most refined organisations will not be immune.

He referenced a leak at NVIDIA, the world’s largest AI infrastructure supplier, attributable to improper patch administration, and a Microsoft Co-Pilot echo leak, in addition to safety failures at DeepSeek and ChatGPT.

“On the very day DeepSeek was launched, their entire database was exposed on the internet – chat histories, API keys, backend operational details, system logs, user prompts, everything,” Obadare disclosed, including that ChatGPT suffered an information breach affecting over 1.2 million subscribers attributable to vulnerabilities in open-source elements.

He additionally criticised what he noticed as non-functional Security Operations Centres throughout the sector.

The skilled emphasised that efficient cybersecurity requires balancing safety actions with sustainable operations. “Resilience is about balancing between protection activities and sustainable activities. When one cheats the other, there will be a problem,” he mentioned.

Olalekan Otufowora, one other skilled, mentioned strong regulatory measures must be applied by the CBN to strengthen the financial sector’s cyber defences.

Otufowora known as on the CBN to restructure its oversight strategy and consolidate supervision of cybersecurity, knowledge safety, and third-party administration inside a single supervisory construction to make sure consistency throughout all regulated entities.