Growing Concerns In Nigeria’s Banking Industry Cybersecurity

Recently, customers of Guaranty Trust Bank woke up to find news of a possible hack of the sever of the bank as cybersecurity experts say the bank may have been a victim of Distributed Denial of Service (DDoS) a type of cyber attack that makes the bank and its customers unable to access the server.
The website of the bank according to cyber security experts had experienced a DDoS which area type of network attack that is relatively simple to carry out, even by an unskilled attacker from multiple sources. A DoS attack results in some sort of interruption of network service to users, devices or applications.
DoS attacks are considered a major risk because they can easily interrupt communication and cause significant loss of time and money. Experts said there have been similar attacks in recent times, it had largely gone unnoticed by customers.
Although social media platforms had been agog with news that the bank had been hacked and the domain of the bank’s website had been sold off, experts said this is not the case even as the communications team of the bank has been unreachable for comments.
According to and ICT and development advisory consultant, Jide Awe, it could be any of two things. “It could be what we call a service attack, a DDoS attack where some attackers will just decide to overwhelm the server with messages which it has to respond to and it wont be able to respond to it because it has been programmed to attend to certain number pf requests at a certain time.
“It could also be that it is an internal problem in the bank. Systems are things that can have problems at anytime, then it could also be that there is a scheduled maintenance. But where there is an issue is that the bank itself is supposed to have informed customers as to what is going on to quell customers anxiety.”
Also, an information systems specialist, Engr Kude Hassan, noted that when it comes to cyber security the strength of the chain is as strong as its weakest link. Banks, every year lose money in billions. Some of them are APT attacks, Advanced Passage Signature attacks. Some of them are, normal attacks.
“For people who have credentials to access their front-end processors, they usually have a credential, a username, password, and then the authorisation. They have multiple levels of authority for all of them.”
Explaining that institutional actors who want to gain access into the system and stay there to gather information, Hassan said, “They go in there and then stay in there so that you get information not that they really want to steal money from you. What is done is to send packets to overwhelm the server. So, the main aim is not to steal money just to deny service for one reason or the other.”
Whilst the website of the bank is up and running, some experts say there may be more of such DDoS attacks on not just bank servers but other institutions in the country.
Earlier in the year, Kaspersky, a cybersecurity firm had noted Nigeria’s concerning trend of an eight percent increase in banking malware attacks in 2023. Despite an overall 10 per cent decrease in threats nationwide, the rise in attacks targeting online banking credentials and sensitive information is a significant cause for alarm.
“Nigeria saw an overall decrease in all threats by 10 per cent while banking malware attacks designed to collect online banking credentials and other sensitive information from infected machines increased by eight per cent,” the statement read.
The statement underscores a broader trend across the African region. While South Africa witnessed a notable 29 per cent decrease in overall cyber threats, phishing attacks leveraging social engineering tactics soared by 29 per cent.
Similarly, Kenya experienced an eight per cent reduction in overall threats yet faced a surge in ransomware attacks by 68 per cent, backdoors by 47 per cent, exploits by 22 per cent, and phishing by 19 per cent.
Analysis from Kaspersky also reveals the varying impact of online threats across different countries. Turkiye emerged with the highest number of users affected by online threats at 41.8 per cent, followed closely by Kenya (39.2%), Qatar (38.8%), and South Africa (35%).
Conversely, Oman (23.4%) and Egypt (27.4%) experienced fewer instances of user impact, trailed by Saudi Arabia (29.9%) and Kuwait (30.8%).
Director of the META Research Centre Global Research and Analysis Team (GReAT) at Kaspersky, Amin Hasbini, attributed the evolving cybersecurity landscape to the proliferation of advanced technologies like AI, alongside escalating geopolitical and economic turbulence within the META region.
These factors collectively contribute to the increasing sophistication and diversity of cyber threats, posing significant challenges for cybersecurity efforts.