The Deep Roots of Nigeria’s Cybersecurity Problem

Website Planet discovered a state health agency's data buckets in Nigeria while working on a web mapping project. Some 75,000 entries were contained in these buckets, along with identification documents and photos of people who are registered with the agency. Website Planet states that the buckets were live and being updated at the time they were discovered.

The agency was launched in September 2020 by the governor of the state, Simon Bako Lalong, to provide cheap and accessible healthcare for residents of the state.

Website Planet informed Nigerian authorities of the exposed data buckets. According to Website Planet, the data buckets were live and secure until July. The longer it was open, the more likely it was to be caught by malicious parties. Personal information found in the buckets could be used to open social media and virtual bank accounts.

Fabong Yildam, director general of PLASCHEMA, denied any data breach or exposure in a press conference on July 23.

In Nigeria, where regulations are ineffective, bad practices run rampant, and public disclosures of security breeches are often slow, the incident is typical.

Many organizations in developed countries communicate when they have cases of cyberattacks, which encourages cyber resilience and widespread incident response. Many organizations deny the occurrence of cyberattacks even in the presence of irrefutable evidence. They play down the event.

The financial details of two major Nigerian banks' customers were exposed in a data breach. Neither bank responded until days later, and then their press releases were vague, neither denying nor admitting to the occurrence of any data breeches.

The sale of emails belonging to the Lagos state government was reported by an independent Nigerian journalist in July. The Lagos state government and Nigeria's cybersecurity agencies didn't deny or respond to the allegations.

By not communicating, these agencies fail to equip their customers and other stakeholders with the information they need to protect themselves. There is a lack of trust and capacity in Nigeria due to the lack of communication.