Early October reportedly saw a string of Nigerian banks cyberattacks that struck a number of lenders and other financial companies. The fraud that followed could run into billions of Naira drawn from customers' accounts, according to TechCabal, which relied on people who were close to events and knew them first-hand. The publication said that on 1 October, intruders got into the systems of a company that supplies core banking software.
For ordinary customers, the central worry is simple: if a shared technology provider fails, many banks can be affected at once. The Central Bank of Nigeria (CBN) had made the same warning weeks earlier.
What the October Nigerian banks cyberattacks involved
According to TechCabal, the vendor operates the central banking platforms on which financial institutions rely, and it was at the heart of the Nigerian banks cyberattacks. The outlet describes the company as among the biggest fintech businesses in Africa, though it does not give a name. TechCabal also noted that it could not work out the number of attacks that took place, how large the losses were, or whether the separate events were linked.
An executive at a payment gateway, speaking without being named, called the month “Black October” in the wake of the Nigerian banks cyberattacks. The executive said firms throughout the financial services sector were hit.
One big microfinance lender was also reportedly caught up in the cyberattacks on Nigerian banks. A source told TechCabal that the lender lost funds and saw its systems disrupted, which pushed it to put together temporary arrangements to keep serving its customers. The same source said the lender has since brought in a head of security.
TechCabal asked NIBSS, the operator of the national payments switch, for comment on the Nigerian banks cyberattacks, but got no reply. A CBN spokesperson said the regulator continues to monitor cyber incidents at the institutions under its supervision, and that its supervisory and cybersecurity requirements remain in effect.
The CBN had warned about vendor risk
On 9 September 2026, a senior CBN official warned that a breach at a single bank, fintech, payment provider or technology vendor could trigger wider disruption across the interconnected financial system. The warning came from Dr Rakiya Opemi Yusuf, the CBN's Director of Payments System Supervision and chair of the Nigeria Electronic Fraud Forum. She spoke at the CIBN's 19th Annual Banking and Finance Conference in Abuja.
Yusuf urged banks to extend cybersecurity and risk management to their technology partners, rather than treating third-party providers as outside their risk perimeter. She also described a “one-fire” effect, in which weakness in one institution spreads quickly to others and can destabilise the whole system.
The October reports read like a test of that warning. A compromise at one vendor can reach every institution that relies on it, whatever the strength of each bank's own defences.
Was the 24-hour rule followed?
Under the CBN's 2024 framework on cybersecurity, supervised institutions must inform the regulator within a day of spotting any cyber incident. They are also expected to submit threat intelligence by day five of the next month. The aim of these rules is to help the regulator spot emerging threats early.
Adherence has been poor in the past. NIBSS reviewed 163 institutions and discovered that only 60 had reported fraud cases in 2023, a 37 per cent compliance rate. Available reporting does not establish whether the institutions hit in October raised the alarm within 24 hours, and the CBN has not said publicly.
The CBN's latest roadway, Payments System Vision 2028, calls for a nationwide Security Operations Centre and a shared platform where intelligence about fraud can be exchanged. Its target is a 70 per cent reduction in fraud losses by 2028. Back in January, the apex bank had already instructed NIBSS to deduct money from the settlement accounts held by commercial banks whenever those institutions receive proceeds of fraud. The CBN anticipates that this will nudge banks and fintechs into examining transactions more closely.
A year of mounting breaches
October did not come out of nowhere. On 4 August 2026, Zenith Bank told customers that hackers had reached a limited set of their data, specifically email addresses and phone numbers. The bank said this was one part of a wider global cyberattack. It said its banking services, digital channels and core systems stayed secure and fully operational. It urged customers to be wary of phishing emails, texts, and calls and never to share their password, PIN or One-Time Password with anyone.
In March 2026, hackers accessed customer data at Sterling Bank, Providus Bank and other Nigerian banks. The federal government vowed in April to investigate, but no public findings have been released. In June, BusinessDay reported that the Nigeria Data Protection Commission was investigating whether data linked to Remita and Sterling Bank had been exposed.
The wider numbers are stark. The CBN's Payments System Vision 2028 put banking-sector and customer losses to fraud at ₦134.48 billion between 2020 and 2025, out of ₦187.79 billion in attempted fraud. Check Point data shows the average Nigerian organisation faced 4,361 attempted cyberattacks a week in June 2026. That was second only to Angola in Africa.
By TechCabal's own count, Access Holdings, GTCO and Zenith Bank between them disclosed ₦2.74 billion in losses to fraud across the opening half of 2026. GTCO's figure climbed by 450.24 per cent year on year.
What customers should ask and what comes next
Three questions matter most. Which vendor was compromised, and which banks use it? Did affected institutions tell the CBN within 24 hours? And will customers who lost money be reimbursed?
None of these has a public answer yet. In the meantime, customers can follow Zenith's advice. They should treat unexpected emails, texts and calls with suspicion, and never share their password, PIN or One-Time Password.
A national cybersecurity framework is in development. It is expected to require firms to report incidents and to spend a minimum amount on cybersecurity. Nigeria has also advanced rules to compel disclosure of cyberattacks. If it lands as described, the opacity around October may become harder to sustain.
- A national cybersecurity framework is in development
- The framework is expected to mandate incident reporting
- The framework is expected to mandate minimum cybersecurity investment
- Nigeria has advanced rules to compel disclosure of cyberattacks
