Nigerian Banks Hit by October Cyberattacks as Fraud Losses Spiral

A wave of cyberattacks struck several Nigerian banks in early October, with potential losses running into billions of naira in customer funds, according to multiple sources with direct knowledge of the matter.

The affected institutions share one trait: they rely on external technology providers to run critical financial services, including core banking infrastructure. In one incident, a vendor that provides core banking services — and is one of Africa's biggest fintech companies — was reportedly compromised at the system level on October 1. The number of attacks, the total money lost, and whether the incidents were connected remain unclear.

The October attacks didn't come out of nowhere. Three of Nigeria's biggest banks — Access Holdings Plc, Guaranty Trust Holding Company Plc (GTCO), and Zenith Bank — collectively reported ₦2.74 billion ($2.03 million) in fraud losses in the first six months of 2026, according to their respective financial reports. GTCO posted the sharpest jump: fraud losses up 450.24% year-on-year.

The Financial Institutions Training Centre (FITC) counted 19,719 fraud cases in the fourth quarter of 2025 — a 34.2% increase from the previous quarter. Reported fraud loss in that quarter surged 575.7% to ₦5.26 billion ($3.89 million).

How bad was 'Black October'?

A top executive at one of Nigeria's payment gateways, who asked not to be named, called the month "Black October," saying the attacks hit businesses across the financial services industry. A source at an investment bank said staff were warned not to open external emails amid heightened threats.

"It eventually ends up at your door," the payments gateway executive said.

"Everyone has been attacked. People have lost money," Adedeji Olowe, founder and CEO of Nigerian lending technology company Lendsqr, told TechCabal. In a November 4 LinkedIn post, Olowe said security testing of Lendsqr's platform uncovered about 800 vulnerabilities, and that they "spent three weeks fixing them." He did not disclose their severity, how many were fixed, or whether any were exploited.

A major microfinance bank was also hit, according to a source familiar with the incident. It suffered financial losses and a system disruption that forced it to seek temporary alternatives to keep services running. It has since hired a chief security officer.

NIBSS, the country's payments switch, did not respond to a request for comment. A Central Bank of Nigeria spokesperson said in an emailed response: "The Bank maintains ongoing supervisory oversight of cybersecurity incidents affecting regulated financial institutions. The Nigerian financial system remains resilient, and the Bank's supervisory and cybersecurity frameworks remain in force."

What does this change for banks and customers?

The core issue is concentration risk. Nigeria's financial industry depends on shared technology providers to process transactions, manage customer accounts, and provide lending infrastructure. A breach at one provider can expose every institution connected to its systems — which is exactly what October demonstrated.

The full-year numbers frame the trend. Financial institutions recorded ₦25.85 billion ($19.16 million) in actual fraud losses in 2025, per NIBSS data — a 50.55% decline from 2024. But the conversion rate is moving the wrong way: in 2024, 60.53% of attempted frauds became losses; in 2025, that jumped to 68.81%.

The CBN has warned that "the payments ecosystem faces rising SIM swap incidents, account takeover fraud, insider collusion, and social engineering" in its Nigeria Payments System Vision 2028. Its 2024 Risk-Based Cybersecurity Framework requires banks and payment service banks to vet third-party providers through due diligence, routine audits, and ongoing monitoring. In March 2026, the CBN formally recognised artificial intelligence as a tool for fighting financial crime.

The reporting gap

Regulation only works if incidents get reported, and here the record is thin. NIBSS's 2023 Annual Fraud Landscape found that only 60 of 163 profiled financial institutions reported fraud incidents that year — a 37% compliance rate. The remaining 103 stayed silent, violating the CBN's circular establishing industry fraud desks.

The 2024 cybersecurity framework requires institutions to report detected cyber incidents within 24 hours and submit threat intelligence by the fifth day of the following month. The CBN's Payment System Vision 2028 proposes a national Security Operations Centre and a fraud intelligence-sharing platform, targeting a 70% reduction in fraud losses by 2028.

There's precedent for accountability. In January, the CBN directed NIBSS to debit the settlement accounts of commercial banks that receive fraud proceeds. And in December 2024, TechCabal reported that First Bank suffered a ₦7 billion ($5.19 million) theft from customer accounts — months after an employee fraudulently diverted ₦60 billion ($44.47 million) over two years, leading to more than 100 dismissals and the CEO's abrupt exit.

For practitioners, the October attacks make vendor due diligence and incident reporting board-level questions, not compliance checkboxes — until reporting gaps close, attacks will keep spreading through shared rails before anyone sees them.