Reports of cyberattacks targeting several Nigerian fintech companies have exposed weak collaboration in sharing intelligence about digital threats across the sector. According to an account published by Olumuyiwa Olowogboyega, multiple fintech firms have suffered attacks since October 2026, with some allegedly losing billions of naira. However, the companies affected have not been identified, and the reported financial losses remain unverified by independent sources.
Lendsqr, a lending-as-a-service startup founded by Adedeji Olowe, detected breach attempts on October 30 following a security review prompted by earlier attacks on other fintech businesses. The review uncovered more than 800 vulnerabilities in the company's code, ranging from minor weaknesses to serious security concerns. The company spent three weeks addressing the issues. Attackers allegedly used stolen developer tokens, attempted to guess employee passwords and sent fake payment notifications to test systems. In one instance, an attacker used a borrower's genuine password but was blocked by Lendsqr's device verification controls. Lendsqr reported no financial loss or customer data compromise from the attempts. However, sources cited by Olowogboyega alleged that one major fintech lost slightly more than N3.5 billion, another lost about N1 billion, while a third incurred approximately $300,000 in costs associated with a month of attacks.
The incidents highlight risks in an interconnected fintech ecosystem where developers, software vendors and service providers may access multiple companies' systems. Lendsqr contacted developers who had worked with it over six years and requested they revoke access tokens and examine their devices. Nigeria's fintech industry previously explored collective approaches to combating digital fraud through Project Radar, a shared registry proposed in March 2023 to help companies identify fraudsters and exchange information. The initiative was renamed Reporta in 2024, although its current operational effectiveness remains unclear. Concerns about customer privacy and the legality of sharing personal information have complicated such collaboration.
The reported incidents have drawn attention to responsibilities under the Nigeria Data Protection Act 2023. Section 40 requires data controllers to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a personal data breach likely to result in a risk to individuals' rights and freedoms. Where a breach is likely to create a high risk to affected individuals, companies must also communicate the incident to them immediately. An official from the NDPC told a news outlet that the law does not require companies to issue public statements after every cyberattack, and an attack on internal infrastructure, source code or payment systems does not automatically constitute a reportable personal data breach if customers' personal information is not compromised. According to Olowogboyega's account, people familiar with the incidents said the reported attacks had not been reported to the NDPC, though the commission has not publicly confirmed the incidents or established whether any involved personal data breaches requiring notification.
The NDPC could help address collaboration challenges by clarifying how fintech companies can lawfully exchange cybersecurity intelligence without violating data protection obligations. Without stronger collaboration mechanisms and information sharing, companies could continue facing attacks using vulnerabilities and compromised credentials that other players in the industry have already encountered.