Senate orders crackdown on bandits flaunting crime cash on TikTok

LAGOS, NIGERIA — By Prime Brief Media

The Nigeria Data Protection Commission has offered a sobering portrait of the nation's escalating cybersecurity crisis, revealing that its own regulatory systems are under near-constant digital siege. NDPC National Commissioner Dr. Vincent Olatunji disclosed on Wednesday that the commission's infrastructure faces approximately 1,500 intrusion attempts every week, a statistic that underscores the scale and relentlessness of the threat confronting both public institutions and private enterprises.

Speaking at the IoT West Africa 2026 conference in Lagos, Dr. Olatunji placed the commission's experiences within the wider national context. Nigeria currently records over 4,000 cyberattacks weekly, a figure the Minister of Communications, Innovation and Digital Economy, Dr. Bosun Tijani, recently attributed to the rapid expansion of the country's digital economy. The convergence of these figures — thousands of attacks against the nation, and over a thousand against the very agency charged with enforcing data protection — paints a picture of a digital ecosystem under persistent and intensifying assault.

The National Commissioner used the platform to highlight a critical structural vulnerability. He warned that over 90 percent of Nigeria's data is currently stored outside its borders, a situation he described as a strategic risk requiring urgent redress. The reliance on foreign-hosted cloud infrastructure and data centres means that sensitive personal, corporate, and government information traverses or resides in jurisdictions beyond the effective regulatory reach of Nigerian authorities. In the event of a major breach, enforcement, recovery, and accountability become vastly more complex.

"The digital economy cannot thrive on borrowed data sovereignty. We must build and secure our own infrastructure," Dr. Olatunji stated. "We cannot continue to outsource the very foundation of our data-driven future."

The NDPC's warning comes amid a series of high-profile cybersecurity incidents that have already inflicted substantial damage. The Corporate Affairs Commission recently suffered a ransomware attack that exposed over 15 million company records and saw 750 gigabytes of data exfiltrated. Sterling Bank experienced a breach affecting 900,000 customer accounts. The Remita government payment platform was also targeted by threat actors seeking to disrupt public financial operations. The Central Bank of Nigeria has issued multiple public advisories urging vigilance against phishing campaigns and other fraud schemes.

Dr. Olatunji made clear that the era of treating data protection as an optional compliance checkbox is over. The NDPC, acting under the powers granted by the Nigeria Data Protection Act 2023, is moving to a posture of robust enforcement. Organisations found non-compliant with statutory data protection obligations now face fines of up to two percent of their annual gross revenue. Crucially, he emphasised that liability extends beyond corporate entities: chief executive officers and other senior executives may also face prosecution for egregious violations or negligence.

"We are done with warnings. The law is clear, and the penalties are real. If you collect or process the personal data of Nigerians, you have a legal and moral duty to protect it. Fail in that duty, and you will be held accountable — not just the company, but the individuals who made the decisions," the National Commissioner stated.

The IoT West Africa conference, which brings together technology leaders, regulators, and innovators from across the continent, also heard that cybersecurity must be positioned as a fundamental enabler of digital transformation, not a cost centre to be minimised. The NDPC is advocating for a whole-of-society approach that includes mandatory breach notification, investment in domestic cybersecurity capacity, and digital literacy campaigns to help citizens protect their own data.