A VECERT threat intelligence analysis reveals a sharp escalation in cyber attacks across West Africa in 2026, with Nigeria bearing the heaviest blow. The real scandal may not be the hacks themselves, but the silence that followed.
By Epiphanus Obia
Sometime in late March 2026, a threat actor known as ByteToBreach walked into Sterling Bank’s systems through a vulnerability the bank already knew about, and had left unrepaired for three months. The attacker spent nine days inside, undisturbed, documenting everything. When ByteToBreach finally went public with the data on a criminal forum, hundreds of thousands of Sterling Bank customers had no idea any of it had happened.
They now know due to media coverage, but the bank as at the time of publishing this story, is yet to issue any public statement acknowledging or refuting the hack.
That breach is only but one of 19 verified cyber incidents targeting Nigerian institutions between January and April 2026, according to threat data tracked by VECERT, a global threat intelligence platform.
Across West Africa, 25 attacks were recorded in the same period, with Nigeria accounting for 76 per cent of them. Eleven other countries in the region recorded zero incidents.
West Africa in the Crosshairs
Of the 16 West African countries monitored by VECERT, only five appear in the threat ledger for 2026: Nigeria (19), Liberia (3), Benin (1), Ghana (1), and Senegal (1). The remaining eleven nations, including Côte d’Ivoire, Burkina Faso, and Mali, returned no verified incidents within the said period.
Nigeria’s dominance of that list is, in part, a result of its size and digital ambition. With Africa’s largest economy, one of its biggest fintech ecosystems, and a government that has been pushing digitisation across public services, Nigeria holds more data, (and more valuable data) than most of its neighbours. That makes it an attractive target, but what makes it a vulnerable one is a different question.
Meanwhile, Liberia’s three incidents were all carried out by a single actor identified as wh6ami, targeting the Ministry of Mines and Energy twice and the Electricity Regulatory Commission once, suggesting a focused, sector-specific campaign against the country’s energy infrastructure. The regional pattern points to Nigeria not as an unlucky outlier, but as the region’s primary front in what cybersecurity analysts are increasingly calling a structural crisis.
A Breach Wave That Kept Getting Worse
Nigeria’s 19 incidents did not arrive evenly. Three were recorded in January, three in February, four in March and then nine in April alone. That is almost more attacks in a single month than in the entire first quarter of the year.
The sectors targeted tell their own story. Government agencies were hit five times, matching the unclassified category in frequency. The financial sector recorded four confirmed incidents. Education absorbed two. Technology, construction, and legal services were each hit once. No institution category was spared.
The Actors: Who Is Actually Doing This
A name that appears repeatedly across this breach wave is ByteToBreach. The actor is responsible for four of Nigeria’s 19 incidents hitting Ikeja Electric, Sterling Bank, the Remita payment platform, and the Corporate Affairs Commission (CAC) between late March and mid-April. It is the most prolific single actor tracked in West Africa in 2026, and it is not a locally grown threat.
ByteToBreach has been active since at least June 2025. Before Nigeria, it had already attacked Nokia, the University of California, PKO Bank (Poland’s largest bank), Uzbekistan Airways, and Sweden’s e-government infrastructure. When it arrived in Nigeria, it did not start gently.
The Sterling Bank breach was the entry point. ByteToBreach gained access through an exposed back door, found Remita’s production credentials stored in plaintext inside Sterling Bank’s code files, and pivoted, without needing to break a second lock. Remita, which processes government salaries, taxes, and federal payments, was never the target. It was collateral damage and a victim of circumstance.
The CAC breach, executed on or around April 10, was different in character and far more alarming in consequence. The Corporate Affairs Commission the authoritative record of every registered company, director, shareholder, board resolution, and identity document submitted in Nigeria’s business history. ByteToBreach obtained full administrative access through an exposed authentication endpoint and exfiltrated approximately 25 million documents (759 gigabytes) which, as of publication, remain publicly downloadable.
“Protecting Nigerians is not my responsibility. That’s the duty of the government.”
— ByteToBreach, when asked about publishing 25 million Nigerians’ personal documents
Beyond ByteToBreach, the threat landscape includes XP95, which targeted Nigeria’s NNPC Health Maintenance Organisation on consecutive days in April, a pattern suggesting prolonged access rather than a one-time hit; iProfessor, who surfaced in late April with 870 gigabytes of data from Fast Credit Finance, containing 939,887 customer records including loan files, ID scans, and personal photographs, offered to just five buyers on a criminal forum; and NormalLeVrai, a cross-border actor active in both Nigeria and Benin, whose focus on archival government data spanning years suggests motivations beyond simple financial gain.
The breaches that defined the year
Corporate Affairs Commission (CAC)
ByteToBreach gained full administrative access on or around April 10, exfiltrating approximately 25 million documents across every portal of the commission’s system. The CAC’s public statement described “unauthorised access to limited aspects of its information systems.” The gap between that language and what the actor published (full portal access, 759GB of downloadable data), is difficult to characterise as anything other than institutional understatement.
Actor: ByteToBreach | Date: April 14, 2026 | Scale: ~25M Documents · 759GB
Remita Payment Services
Approximately three terabytes of data, including over 800 gigabytes of KYC documentation, government HSM keys, database dumps, and container registries. The breach originated in Sterling Bank, not in Remita’s own systems. Remita’s production credentials were stored in plaintext inside Sterling Bank’s code repository.
Actor: ByteToBreach | Date: March 31, 2026 | Scale: ~3 Terabytes
Fast Credit Finance
870 gigabytes, 939,887 records. Loan agreements, bank statements, next-of-kin details, and personal photographs. As of publication, no official statement has been issued by Fast Credit, the Central Bank of Nigeria, or the Nigeria Data Protection Commission confirming the full scale of what was taken. The data was offered for sale exclusively to five buyers.
Actor: iProfessor | Date: April 25, 2026 | Scale: 870GB · 939,887 Records
Sterling Bank
900,000 customer accounts. 3,000 employee records. BVNs, NINs, passports. The bank knew about the vulnerability for three months before the breach. When ByteToBreach made contact before publishing, Sterling Bank negotiated a ransom of €250,000 in secret, without informing a single customer. ByteToBreach eventually lost patience and published anyway. The bank said nothing publicly.
Actor: ByteToBreach | Date: March 27, 2026 | Scale: 900,000 Accounts
The silence that marred the story
Sterling Bank said nothing to its customers. Remita also, said nothing to its customers. The CAC issued a statement that barely resembled what had actually happened. None of them apologised.
Nigeria’s Data Protection Act 2023 does not permit this. It mandates breach notification within 72 hours. The Nigeria Data Protection Commission has since launched investigations into the CAC, Remita, and Sterling Bank. It has also directed all government agencies and private data controllers to appoint trained data protection officers, enforce multi-factor authentication, and maintain proper incident response processes.
The Bigger Picture
The VECERT data is only but a snapshot. It captures verified, publicly surfaced threats, incidents significant enough to appear on criminal forums or in threat intelligence feeds, but the full picture is considerably larger.
Nigeria recorded more than 119,000 data breaches in the first quarter of 2025 alone. More than 60 million Nigerian records were reportedly traded on dark web markets in the nine-month window of January to September 2025. The country lost an estimated $3 billion to cybercrime between 2019 and 2025, according to INTERPOL data, with annual losses now approaching $500 million.
Nigeria ranked 12th among all foreign countries filing cybercrime complaints with the FBI’s Internet Crime Complaint Centre in 2025. Global cybercrime losses crossed $20.8 billion that year, a 26 per cent jump from 2024.
The cybersecurity market in Nigeria was valued at $230 million in 2025 and is projected to reach $415 million by 2031. Investment is growing. But the breach wave of early 2026 suggests that investment has not yet caught up with exposure, and that the institutions entrusted with the most sensitive data in the country are still, leaving doors open that have been known to be broken for months.
Access the interactive visualisation of the story, published as artifact on Claude using the link below