Nigeria

This page covers cyber threats to Nigeria. It brings together official Nigerian texts (the National Information Technology Development Agency NITDA and its emergency response team CERRT, the Nigerian Communications Commission NCC and the Federal Ministry of Communications, Innovation and Digital Economy), a joint US advisory and MITRE ATT&CK. Where an official source says Nigeria was a target, the page says who said it and when.

Threat groups that official sources link to Nigeria

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT38: the US advisory AA20-239A, first issued on 26 August 2020 by CISA, the Treasury, the FBI and US Cyber Command, describes a North Korean team it calls the BeagleBoyz that robs banks through remote internet access. It says the team likely targeted financial institutions in a list of nations from 2015 through 2020, and Nigeria is on that list. The advisory says the BeagleBoyz overlap with groups tracked as APT38 and Lazarus. MITRE ATT&CK describes APT38 as a North Korean state-sponsored group that specializes in financial cyber operations and says it has been attributed to the Reconnaissance General Bureau. The advisory gives no incident count or loss figure for Nigeria.

Incidents on record

This section lists only major incidents with national impact that official or widely reported sources document. No incident page for Nigeria is listed yet.

What Nigerian authorities say about the threat

On 4 August 2026 NITDA urged federal ministries, departments and agencies to take a coordinated approach to securing government digital infrastructure. Its Director General said website defacement, ransomware attacks, data breaches and the misuse of personal information now pose serious risks to governance, public trust and national development. He said government websites had been defaced, hijacked and redirected to gambling sites, and that ransomware attacks had forced government web portals to shut down. He also cited a UNODC assessment that named Nigeria as one of Africa’s three most targeted countries because of its expanding digital economy and growing attack surface. At a March 2025 meeting on UK and Nigeria cooperation, officials said Nigeria has about 8,300 cybersecurity experts, which they said is not enough.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The NCC resources page lists the Nigeria Data Protection Act 2023 (as an official gazette), the CyberCrime Prohibition Prevention Act 2024, the National Cybersecurity Policy and Strategy 2021 and a Cyber Resilience Framework for the Nigeria communication sector. NITDA works under the National Information Technology Development Act (2007), which mandates it to set standards, guidelines and frameworks for information technology, and its list of instruments includes the NDPR Implementation Framework. NITDA presented its first annual report on the Nigeria Data Protection Regulation (NDPR) on 17 October 2020. The Communications Minister said that shortly after taking office in 2023 President Tinubu signed the Nigeria Data Protection Act into law.

How incident response is organized

NITDA runs the Computer Emergency Readiness and Response Team (CERRT), which lists 2014 as its founding year and offers round-the-clock incident response to Nigerian organizations. NITDA calls it the government’s first point of contact during cyber incidents. The NCC runs a CSIRT for the telecommunication industry, and says it works with the national CERT (ngCERT) at the Office of the National Security Adviser. NITDA’s Cybersecurity Department standardizes the setting up of cybersecurity structures in ministries, agencies and the private sector.

Personal data

The Nigeria Data Protection Commission (NDPC) is the data protection regulator. On a page dated 15 September 2026 the Communications Minister said he commissioned the new NDPC headquarters in Abuja, that the President had directed federal bodies to comply with data protection laws, and spoke of protecting the data of over 200 million Nigerians.

The official sources give no national attack counts for Nigeria.