Nigeria’s fast-growing digital economy is facing escalating cyber threats, with new figures revealing that the country now suffers over 4,000 cyberattacks every week, raising serious concerns about security, infrastructure gaps, and data sovereignty.
Data presented by the Nigeria Data Protection Commission (NDPC) at the IoT West Africa Conference 2026 shows that cyberattacks are not only increasing in frequency but also in financial impact, with Nigeria losing an estimated N12 billion to cybercrime in 2024 alone.
The report further revealed that nearly 90 percent of Nigeria’s data is hosted outside Africa, forcing the country to spend about $850 million annually on foreign cloud infrastructure. This heavy reliance on offshore systems has sparked concerns over national data control, security exposure, and economic leakage.
NDPC National Commissioner and CEO, Dr. Vincent Olatunji, warned that while Nigeria’s digital economy is expanding rapidly, security frameworks and infrastructure are not evolving at the same pace.
He noted that Nigeria’s digital economy, currently valued at about $18.3 billion and contributing nearly 20 percent to GDP, is increasingly driven by mobile connectivity, artificial intelligence, and Internet of Things (IoT) technologies. However, he stressed that “data is no longer just an asset; it has become critical infrastructure.”
Globally, cyber risks are also intensifying, with reports indicating that cyberattacks now occur every 39 seconds, placing digitally dependent economies like Nigeria under greater pressure.
Nigeria is currently among the most targeted countries in Africa, accounting for about 45 percent of reported cybercrime incidents on the continent. Common attack methods include phishing, ransomware, business email compromise, distributed denial-of-service (DDoS), identity theft, and financial fraud targeting banks, telecom systems, and government platforms.
A major structural concern is Nigeria’s reliance on foreign data hosting, with experts warning that this undermines sovereignty, increases security risks, and limits national control over critical information systems.
To address these challenges, the NDPC has introduced stricter regulatory measures under the Nigeria Data Protection Act (NDPA) 2023 and GAID 2025 framework, including mandatory breach reporting within 72 hours, ISO certification requirements, and compulsory audits for data controllers and processors.
Cybersecurity experts also warn that while digital innovation is accelerating, weak system design and poor implementation continue to expose Nigeria’s digital infrastructure to attackers who increasingly exploit structural vulnerabilities rather than advanced hacking techniques.



