Reported October cyberattacks expose risks in Nigeria’s shared banking infrastructure

Several Nigerian banks and financial institutions were reportedly affected by cyberattacks in early October, with sources citing fraud losses involving customer funds and at least one disruption to banking services.

The incidents reportedly included institutions that depend on external providers for core banking and other critical financial services. Sources said a vendor providing core-banking technology to financial institutions was compromised at the system level on October 1. The vendor’s identity was not disclosed.

It remains unclear how many attacks occurred, how much money was lost in total or whether the reported incidents were connected. The accounts were provided by sources with direct knowledge of the matter and were not independently verified.

Service disruption and reported losses

A source familiar with an incident involving a major microfinance bank said the institution suffered financial losses and a system disruption. The bank reportedly turned to temporary alternatives to keep its services running and later hired a chief security officer.

An executive at a Nigerian payment gateway described October as “Black October,” saying the attacks affected businesses across the financial-services industry. “It eventually ends up at your door,” the executive said.

An investment-bank source also said staff were warned not to open external emails during the month because of heightened cyber threats.

Separate financial reports show that Access Holdings Plc, Guaranty Trust Holding Company Plc and Zenith Bank collectively reported ₦2.74 billion in fraud losses during the first six months of 2026. GTCO reported a 450.24% year-on-year increase in fraud losses. The reports do not establish that these figures were linked to the October incidents.

Regulators and industry response

A Central Bank of Nigeria spokesperson said the regulator maintains supervisory oversight of cybersecurity incidents affecting regulated financial institutions.

“The Nigerian financial system remains resilient, and the Bank’s supervisory and cybersecurity frameworks remain in force,” the spokesperson said in an emailed response.

The CBN’s 2024 Risk-Based Cybersecurity Framework requires supervised institutions to report detected cyber incidents within 24 hours. It also requires cyber-threat intelligence to be submitted by the fifth day of the following month.

Under its Payment System Vision 2028, the central bank has proposed a national Security Operations Centre and a fraud intelligence-sharing platform. It has set an ambition of reducing fraud losses by 70% by 2028 and has warned about SIM swaps, account takeovers, insider collusion and social engineering.

The CBN also directed the Nigeria Inter-Bank Settlement System to debit the settlement accounts of commercial banks that receive fraud proceeds.

Fraud losses remain a wider concern

Data from the Financial Institutions Training Centre showed 19,719 fraud cases in the fourth quarter of 2025, up 34.2% from the previous quarter. Reported fraud losses rose 575.7% to ₦5.26 billion during the same period.

NIBSS data showed that Nigerian financial institutions recorded ₦25.85 billion in actual fraud losses in 2025, although that represented a 50.55% decline from 2024. The proportion of attempted frauds that became losses increased from 60.53% in 2024 to 68.81% in 2025.

In its 2023 Annual Fraud Landscape, NIBSS said only 60 of 163 profiled financial institutions reported fraud incidents, representing a 37% compliance rate. The remaining 103 institutions did not report cases.

Adedeji Olowe, founder and chief executive officer of Lendsqr, said, “Everyone has been attacked. People have lost money.” In a November 4 LinkedIn post, Olowe said Lendsqr’s security testing uncovered about 800 vulnerabilities and that the company “spent three weeks fixing them.” He did not disclose their severity, how many had been fixed or whether any were exploited.

NIBSS did not respond to a request for comment. The identities of the other affected institutions and sources were not disclosed.