281,500 Nigerian Accounts Breached Amid 4,700 Weekly Cyberattacks

Fraudsters successfully circumvented digital security controls in transactions worth over N1bn across West Africa between January and June 2026, highlighting growing vulnerabilities in the region’s financial and digital ecosystem as criminals increasingly exploit valid credentials, trusted platforms and authorised user access.

The development, contained in the H1 2026 threat landscape report by cybersecurity firm esentry, is raising concerns over the effectiveness of conventional security systems as cybercriminals increasingly exploit trusted digital environments rather than relying solely on conventional software vulnerabilities.

According to the report, the N1bn-plus fraud was uncovered in three major incidents investigated by esentry’s Digital Forensics and Incident Response team, with none of the attacks triggering security alerts while they were taking place.

The incidents were discovered only after routine audits, customer support complaints or settlement warnings, highlighting what the cybersecurity firm described as a widening gap between the volume of threats organisations monitor and their ability to identify fraudulent activities in real time.

The report is particularly significant for Nigeria, where banks, fintech companies and payment service providers have rapidly expanded their digital infrastructure, resulting in millions of customer accounts and increased dependence on application programming interfaces, cloud environments and third-party technology platforms.

It said Nigerian organisations experienced an average of more than 4,700 cyberattacks every week during the first half of the year, while 281,500 Nigerian accounts were newly breached in the first quarter alone.

The scale of the threat comes as financial institutions increasingly rely on automated systems to monitor large volumes of digital transactions and identify suspicious activities.

However, esentry said the three major fraud incidents demonstrated that a large number of security alerts did not necessarily translate into effective fraud prevention.

Rather than exploiting sophisticated software vulnerabilities, the attackers allegedly operated through legitimate credentials, active sessions and access to trusted environments, while inadequate logging prevented security teams from detecting the suspicious activities as they occurred.

Gbolabo Awelewa, Chief Business Officer at esentry, said cybercriminals were increasingly exploiting trust rather than vulnerabilities.

He noted that legitimate credentials, trusted developer tools, familiar software-as-a-service platforms and artificial intelligence-enabled workflows could become entry points for attackers when organisations lacked adequate controls and visibility.

The development suggests that security strategies focused primarily on identifying and patching software vulnerabilities may no longer be sufficient to protect financial institutions and other organisations operating highly digitised platforms.

The report said organisations must increasingly monitor how legitimate identities and authorised systems are being used, particularly where attackers can obtain valid credentials and operate within environments that security teams already consider trusted.

Nigeria’s vulnerability was further highlighted by esentry’s offensive security division, which recorded unauthorised access in all 175 security engagements it conducted during the period.

The engagements included penetration testing, social engineering exercises and cloud security assessments.

According to the report, none of the exercises required the use of a zero-day vulnerability, with the successful breaches attributed largely to weaknesses in authorisation design.

This, esentry said, indicates that some of the most serious cyber risks facing African businesses could stem from basic security-control failures rather than highly sophisticated or previously unknown vulnerabilities.

The report also warned that attackers were becoming increasingly rapid in exploiting newly disclosed software vulnerabilities.

In its collaboration with Darktrace, an artificial intelligence cybersecurity company, esentry examined the React2Shell vulnerability disclosed in December 2025.

Darktrace found that cybercriminals developed a working exploit within 30 hours of the vulnerability becoming public, while a decoy system deployed by its researchers was compromised within two minutes of being connected to the internet.

The findings underline the shrinking window available to organisations to identify, patch and contain emerging vulnerabilities, particularly as attackers automate parts of the cyberattack process.

Beyond Nigeria, the report identified growing cyber risks in other West African markets.
In Ghana, the national Computer Emergency Response Team recorded more than 3,500 confirmed cybersecurity incidents in the first quarter of 2026.

The country also recorded 352 fraudulent online investment schemes between January and June, with victims losing a combined GHS3.43 million.

The sectors targeted in Ghana broadly mirrored the Nigerian experience, with financial services, government platforms and telecommunications among the major targets.

Esentry said the similarities in attack patterns across West African countries presented an opportunity for stronger regional cooperation, particularly through the sharing of threat intelligence and information on emerging attack techniques.

It said intelligence gathered from incidents in Nigeria could be applied to strengthen cybersecurity defences in other West African markets, rather than countries developing their responses in isolation.

For businesses, the report recommended that cybersecurity investment should move beyond simply blocking known malware and vulnerabilities to improving visibility into legitimate activities taking place across their digital environments.

Esentry recommended making egress logging and authentication source-IP retention standard security controls, while ensuring that backend authorisation is enforced across every application endpoint.

The company also said it had introduced restrictions around its new agentic artificial intelligence security capability, requiring human approval for high-impact decisions.

According to the report, the experience from the three major undetected fraud incidents demonstrates that increasing the number of security alerts does not automatically translate into stronger protection.

The more fundamental challenge, it said, is the ability of organisations to distinguish malicious behaviour from legitimate activity when attackers operate through credentials, platforms and workflows that businesses already trust.

For Nigeria’s rapidly expanding digital economy, the findings reinforce the need for banks, fintechs, payment companies, telecommunications operators and other businesses to strengthen identity management, authorisation controls, transaction monitoring, logging and real-time visibility.

As digital transactions continue to expand across the region, the report warned that cybercriminals are increasingly finding ways to hide within legitimate digital activity, creating a security challenge that conventional perimeter-based defences may struggle to address.

281,500 Nigerian Accounts Breached Amid 4,700 Weekly Cyberattacks is first published on The Whistler Newspaper