Nigeria is experiencing a rise in cyberattacks driven largely by preventable security lapses rather than advanced hacking techniques, according to a cybersecurity advisory by Digital Encode Limited.
The firm warned that recent breaches affecting financial institutions, fintech companies, government agencies and other organisations are increasingly linked to weak configurations, exposed systems and poor credential management.
It said cyber threat actors are exploiting misconfigured cloud services, unsecured databases, exposed application programming interfaces, leaked credentials and publicly accessible storage systems.
According to the advisory, many of the compromised systems were exposed through basic operational weaknesses such as hardcoded API keys, weak authentication controls, and improperly secured cloud storage environments.
The firm noted that sensitive data has in some cases been found in publicly accessible repositories, cloud buckets, and development environments that were not properly secured before deployment.
Digital Encode said the pattern suggests that most incidents are not the result of sophisticated zero-day exploits but rather “preventable weaknesses in basic security configurations and operational controls”.
It added that similar vulnerabilities are being observed across multiple sectors, particularly in financial services, payment platforms, fintech companies and public sector digital systems.
The advisory, signed by the company’s Chief Visionary Officer, Professor Obadare Peter, highlighted recurring issues such as exposed administrative endpoints, weak token management, lack of proper access controls, and poor vendor risk oversight.
“Most recent breaches are not due to highly advanced attacks but lapses in enforcing existing security controls,” the advisory stated.
It urged organisations to urgently audit internet-facing assets, rotate exposed credentials, strengthen authentication systems, and improve monitoring and incident detection capabilities.
The firm also called attention to the growing risk posed by “shadow IT” and unauthorised deployments linked to employee accounts, warning that these often serve as entry points for attackers.
Digital Encode stressed that addressing these weaknesses requires stronger execution of existing cybersecurity policies rather than entirely new technologies.
It added that improving basic security hygiene will be critical to strengthening resilience as Nigeria’s digital ecosystem continues to expand.
