A cybersecurity professional, Anthony Fakiyesi, says data localisation alone cannot adequately protect Nigeria’s digital ecosystem from rising cyber threats.

Mr Fakiyesi made the disclosure during an interview on Saturday in Lagos while analysing cybersecurity trends in 2026.

He said Nigeria had recorded an average of more than 4,700 cyberattacks weekly since the beginning of the year.

Mr Fakiyesi said Nigeria’s policy direction reflected growing recognition of the need for greater control over critical data and digital sovereignty.

He cited the Central Bank’s data localisation directive as part of efforts to strengthen control over sensitive information.

The expert, however, said data localisation must be complemented by stronger identity management, access controls and third-party risk management.

“Control without resilience is insufficient,” he said, noting that localising data would not reduce cyber risks if access systems remained vulnerable.

“The broader implication is clear. Cybersecurity is no longer a technical concern at the margins of organisations; it is a systemic issue.

“It underpins economic stability and institutional trust as Nigeria accelerates digital transformation across finance, government and commerce,” he said.

Mr Fakiyesi said the growing use of legitimate credentials, compromised identities and trusted third-party platforms by attackers had fundamentally changed the cybersecurity landscape.

He said organisations were increasingly exposed through vendors, software platforms and other digital services integrated into their operations.

The expert said Nigeria recorded more than 281,000 leaked user accounts in the first quarter of 2026.

He said cyberattacks were increasingly concentrated on sectors holding valuable financial and personal information, including banks, fintechs, telecommunications providers and government institutions.

Mr Fakiyesi said the shift from conventional attacks targeting system weaknesses to attacks exploiting legitimate access meant traditional security measures were no longer sufficient.

He stated that attackers could operate within compromised systems without immediately raising suspicion after obtaining valid credentials or accessing trusted integrations.

According to him, the development made supply chains and third-party relationships critical components of organisations’ cybersecurity posture.

“The most consequential cyber incidents of 2026 are concentrated across telecommunications, SaaS platforms, financial services and enterprise infrastructure, where identity, data and access converge at scale.

“Breaches affecting major organisations in these industries reveal a consistent pattern: attackers are navigating systems through valid credentials and third-party access.

“Organisations do not just manage their own vulnerabilities; they inherit risk from every system they trust,” he said.

Mr Fakiyesi also expressed concern over limited visibility of cyber incidents in Nigeria, saying inadequate disclosure made it difficult to identify recurring vulnerabilities and strengthen collective defences.

According to him, cybercrime costs Nigeria an estimated $500 million annually, with the risk expected to grow as more transactions and services move online.

He said Nigeria’s digital transformation needed to be matched by stronger cybersecurity governance, incident reporting and resilience.

Mr Fakiyesi urged organisations to strengthen identity protection, monitor third-party access, improve incident reporting and build resilience across their digital ecosystems.

He said Nigeria’s pursuit of greater control over its data must be accompanied by measures to secure systems controlling access to such data.

The expert said the ability to secure digital trust would increasingly determine the resilience of Nigerian institutions as the country deepened its digital economy.

He added, “Nigeria’s rapid digital transformation in the financial, government and commercial sectors makes it imperative for institutions to strengthen their ability to withstand increasingly sophisticated cyber threats.”
(NAN)