Nigeria is reviewing its cybersecurity laws to counter mounting threats as artificial intelligence (AI) makes fraud, digital deception, and attacks on critical infrastructure harder to detect.
AI was linked to 55% of cybercrime incidents recorded across Africa last year, while deepfake cases increased sevenfold between the second and fourth quarters of 2024. Cybercriminals are using AI to automate scams, create convincing fake identities, and more quickly identify weaknesses in critical systems. This means attackers are adopting the technology faster than institutions can strengthen their defences, leaving existing security systems and laws struggling to keep up.
This growing technology gap is the primary driver behind the current legislative review, as the Nigerian government acknowledges that existing frameworks fail to provide adequate guardrails or align with international best practices.
Nigeria is also considering a national cybersecurity architecture to establish baseline security standards for organisations nationwide. However, unless these reforms improve enforcement, fortify vulnerable infrastructure, and foster local technical expertise, they risk expanding state surveillance powers without making Nigeria’s digital economy any safer.
Nigeria’s cybersecurity reforms are progressing along three distinct tracks. The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 was amended in February 2024, while a broader policy review convened lawmakers, government agencies, and industry stakeholders in Lagos. The National Cybersecurity Policy and Strategy, first introduced in 2014 and revised in 2021, is due for its five-year review in 2026. Meanwhile, the proposed National Digital Economy and E-Governance Bill 2025, which underwent a public hearing in November 2025, aims to establish a comprehensive legal framework for digital services and e-governance.
Together, these initiatives address cybercrime enforcement, institutional security, and the governance of Nigeria’s expanding digital economy.
What is the government trying to fix?
The government says it has advanced work on a draft executive bill designed to strengthen the nation’s legal protections against cyber threats.
In October 2026, Adedeji Stanley Olajide, Chairman of the House Committee on ICT & Cybersecurity, told TechCabal on the sidelines of the International Cybersecurity Conference in Abuja that “the timeline is immediately after the election…” because not much can happen during political campaign season.
The lawmaker, however, expressed confidence that between January and June 2027, “the cybercrime, cybersecurity, and digital economy bills” would all be enacted into law.
He maintained that, once enacted, these laws would curb cyberbullying and other cyber threats and enforce stricter compliance and security standards across the financial sector.
The urgency for reform is evident: nine in ten Nigerian children face risks of cyberbullying, harassment, and online exploitation.
Financial institutions under siege
Nigeria’s financial sector also faces pressing vulnerabilities. In 2025, Nigeria lost ₦25.85 billion ($19.2 million) to electronic payment fraud. In September 2026, the Central Bank of Nigeria (CBN) cautioned banks, fintechs, and payment service providers that cyber risks and AI-driven vulnerabilities pose direct threats to financial stability.
These warnings align with findings from TC Insights’ report: “The Compliance Reckoning: Regulating Financial Services in the Age of AI.” The study notes that while gross fraud losses decreased in 2025, AI-powered attacks have grown considerably more sophisticated, with escalating regulatory fines underscoring systemic compliance risks.
In 2025 also, the Nigeria Data Protection Commission (NDPC) fined MultiChoice Nigeria ₦766.24 million ($568,630) for data protection breaches and unauthorised cross-border transfers of personal data. Also, the Commission launched investigations into 1,369 organisations across the banking, insurance, pensions, and gaming sectors
In a separate case, the Economic and Financial Crimes Commission (EFCC) investigated a ₦3 billion ($2.23 million) fraud scheme that targeted First City Monument Bank customer accounts through unauthorised access.
These incidents demonstrate how systemic cyber vulnerabilities leave consumers exposed, compromise sensitive records, and erode trust in public institutions.
Even the government is not safe
Nigeria’s cybersecurity risks also extend to public institutions as government infrastructure has proven vulnerable. The AI-generated photo controversy involving the Independent National Electoral Commission’s voter register revealed that suspicious voter records entered the commission’s database through authorised registration terminals operated by its own officials, rather than via an external hack. It exposed a weakness in how public institutions control access, monitor staff activity, and verify data before adding it to their systems.
The Corporate Affairs Commission experienced a major breach exposing over 15 million corporate documents and beneficial ownership records. Meanwhile, Remita—the central payment gateway for Nigeria’s Treasury Single Account—suffered a data exposure due to a misconfigured cloud storage bucket that leaked nearly three terabytes of financial data.
Vincent Olatunji, NDPC National Commissioner, at a five-day hands-on cybersecurity training for technical personnel in government ministries, departments and agencies, in June, disclosed that the commission faced over 2,000 cyberattack attempts on its portal in one week.
These incidents highlight the growing threats facing institutions responsible for protecting Nigerians’ personal data, even as e-governance expands.
Across Africa, the case is not different: detecting intrusions is now harder as AI transforms routine cybercrime into automated reconnaissance, synthetic identity fraud, and credential hijacking.
Findings from Esentry and Darktrace—a cybersecurity intelligence partnership focused on enterprise threats—reveal that modern attackers rarely force their way in through software flaws; they enter via compromised credentials and weaponised internal trust that slip cleanly past conventional security alerts. According to the report, West Africa lost over ₦1 billion ($742,104) in fraudulent transactions that slipped past legacy security controls in the first half of 2026 alone.
This dynamic hits Nigeria with disproportionate severity. While South Africa accounted for 45% of Darktrace-observed incidents (20% ransomware), Kenya accounted for 6% (33% ransomware), and Nigeria accounted for only 5% of regional volume. However, ransomware was present in 80% of the investigated Nigerian cases, with data exfiltration in 40%—proving that Nigeria’s cyber risk far outstrips its visibility, masking high-impact extortion behind low detection numbers.
Rather than breaching perimeter walls, threat actors now leverage AI-enabled behavioural evasion to mimic legitimate user actions and quietly hijack authorised workflows—rendering static government firewalls and manual compliance audits obsolete.
Breaches of this magnitude undermine public trust in official registries and jeopardise data essential for corporate verification and anti-money laundering enforcement.
These failures highlight a critical requirement for new cybercrime legislation to establish clear accountability and enforce proper configuration standards for critical data infrastructure.
As legislative frameworks expand, lawmakers must balance state oversight with the protection of privacy and civil liberties. The true efficacy of these reforms will lie in whether they yield higher prosecution rates, fewer systemic breaches, and stronger data protection.
Building local capacity, not foreign dependence
For Nigeria, meaningful investment in cybersecurity sovereignty requires building internal capabilities to secure critical infrastructure, safeguard citizen data, investigate cybercrimes, and maintain vital digital services. Crucially, it also means curbing reliance on external vendors for system maintenance and incident response.
The government’s National Digital Cloud Policy attempts to address these challenges by granting tax and duty waivers on servers and data centre infrastructure to attract private investment. In return, the policy directs federal agencies to migrate legacy systems to the cloud while mandating that sensitive national data—including biometric and healthcare records—remain hosted within Nigerian borders.
Official reports state that over ₦4.5 trillion ($3.34 billion) was allocated to Nigeria’s information technology sector between June 2023 and June 2026.
Additionally, Nigeria aims to attract $250 million in private investment within 12 months and $750 million within 24 months. However, capital targets alone do not guarantee enhanced security capacity. The ultimate test remains whether these capital flows translate into resilient infrastructure, institutional capability, and skilled local talent.
As Abdul-Hakeem B.D. Ajijola, Chair of the African Union Cyber Security Expert Group, noted at the international cybersecurity conference mentioned earlier that the value of security investments must be measured by the capabilities that remain after vendor contracts expire. Procuring third-party software provides temporary protection, but without skilled local engineers to maintain and defend these systems, Nigeria risks trading technological vulnerability for vendor lock-in.
AI is shifting from an advantage for attackers to a standard part of offensive infrastructure. Essentry and Darktrace’s forecasts for the second half of 2026 point to an acceleration in deepfake-driven executive fraud, software supply chain compromises, and automated ransomware targeting cloud assets.
Progress must therefore be measured by operational outcomes: faster threat detection, prompt vulnerability patching, mandatory breach disclosure, rapid service recovery, and strict accountability for non-compliance with minimum standards.
Updating legislative frameworks can clarify agency responsibilities and expand investigative mandates. However, reforms should not be judged merely by the scope of powers granted to the state, but by whether citizens’ data is protected, financial infrastructure remains resilient, and public services can withstand sophisticated attacks.
Ultimately, Nigeria’s success will not depend on passing stricter cybersecurity laws, but on building a digital ecosystem capable of defending itself, recovering from security incidents, and safeguarding the public.