E-Business
Africa: 2023 Cyberthreats Landscape, Next Year Predictions

By Yusuph Kileo
In recent years, of African countries are working hard to adopt 2030 African digital transformation agenda. Finance, education, agriculture, government, security, and manufacturing, are actively adopting digital technologies and transitioning their operations to online platforms.
As we advance in technology throughout the continent, nations need to remember, cybersecurity and personal data protection are fundamental principles in the implementation of the digital transformation project in order to minimise the challenges that come along with the technology.
The year 2023 was filled with countless cyberattacks across many countries — Some of these attacks targeted critical infrastructure, financial institutions, governments and other companies.
As African countries are now pushing for digital transformation and experiencing rapid economic development, cybersecurity remains a pressing concern for businesses across Africa.
Unfortunately, some of the African countries indicate inadequate security measures to fight off cybercrime, leaving them highly susceptible to cyberattacks — They have weak prevention mechanisms to combat cyber threats and poor intrusion detection systems, thereby placing sensitive transactions at significant risk.
There is an increase in the volume and sophistication of cyberattacks in financial institutions.
According to the 2023 Africa Financial Industry Barometer, 97% of surveyed leaders of financial institutions in Africa rank cybercrime and regulatory constraints on cybersecurity as the leading threat to the financial services industry alongside worsening economic conditions.
These massive cyberattacks in the region threatens the security of the growing economy and critical infrastructure.
MTN Nigeria, lost $53 million from its mobile money service which forces them to sue several banks in the Nigeria, financial institutions and e-citizen portal where halted by distributed denial of service attack in Kenya, South Africa there is an increase in backdoor and spyware attacks with an alarming 106,000 recorded attempts.
There are many similar cybersecurity incidents in other African countries and there is a need of urgent action to strengthen protection measures.
Failure to counter cyberthreats can have serious consequences for individuals, businesses and the socio-economic development of the continent.
Africa is not alone in this, In September alone other part of the world experience massive cyberattacks — To mention few notable cyberattacks; On September 6, the travel booking company Sabre experienced a serious ransomware attack where by 1.3 terabytes of data were stolen by Dunghill and just few days letter, on September 11th another ransomware attack on save the children lead to the loss of 6.8 terabyte of data and entertainment company MGM Resorts also suffered a cyberattack which was made public on X saying that the security incident severely impacted its business operations.
The following day on September 12, Hong Kong-based cryptocurrency exchange platform, CoinEx, saw the loss of US$70 million in cryptocurrency following a cyberattack launched against it.
In 2023, the most common cyberthreats in Africa includes Insider threats, Social Engineering, Software update supply chain attacks, Phishing attacks, Mobile malware, online shopping fraud, Ransomware, Man-in-the-middle (MitM) attack, Cryptojacking attacks, IoT botnet DDoS attacks and Malware attacks among others.
According to the year 2023 Positive technology report, the most targeted organizations with cyberattacks were those in the financial sector (18%), followed by telecommunications companies (13%), government agencies (12%), and organizations from the trade (12%) and industrial (10%) sectors.
The impact brought by these growing cyberattacks includes, Loss of customer/business, Loss of organisation critical data, Threat to organisation/National Security, Damage of goodwill and Reputation, Loss of Revenue — Economic Losses, Temporary or permanent closure, Lawsuits and arbitrations, Danger of terrorism, Time wastage and System down time — reduce productivity.
2024 cyberthreats prediction
Many report shows Africa being the most targeted region with cyberattacks, the year 2024 new techniques of cyberattacks will likely emerge, such as the increase in AI usage, hacktivism and targeting of smart home tech.
New botnets and rootkits will also likely appear, and hacker-for-hire services might increase, as will supply chain attacks, which might be provided as a service on cybercriminals’ underground forums.
According to Kaspersky, Advanced Persistent Threats (APT) is expected to expand surveillance efforts to include more smart home technology devices, such as smart home cameras and connected car systems.
This is particularly interesting for attackers because those devices are often uncontrolled, not updated or patched and subject to misconfigurations. This is also a concern because more people work from home nowadays, and their companies could be targeted via weak points in the home worker devices.
More hacktivism is expected affect many parts of Africa. Hacktivists will run Distributed Denial of Service attacks, increasingly use tools for Deepfakes and impersonation/disinformation. In addition, destructive and disruptive operations can be done. T
he use of wipers in several current political conflicts or the disruption of power in Ukraine are good examples of both types of operations.
Cybercriminals are also expected to develop new methods for automating cyberespionage. One method could be to automate the collection of information related to victims in every aspect of their online presence: social media, websites and more, as long as it relates to the victims’ identity.
State-sponsored cyberattack numbers also have the potential to surge, amid increasing geopolitical tensions. These attacks will likely threaten data theft or encryption, IT infrastructure destruction, long-term espionage, and cyber-sabotage.
The generative AI tools usage will increase, this will facilitate the mass production of spear phishing email content, which is often used as the initial vector of infection when targeting organizations. The messages written by the tools are more persuasive and well-written compared to the ones written by cybercriminals. It might also mimic the writing style of specific individuals.
The widespread use of technology, combined with insufficient cybersecurity measures, lack of right skillset, inadequate legislation in the field of information security, and a low level of public awareness concerning information security, creates favorable conditions for cybercriminals. Moreover, many African countries are facing economic constraints, making it difficult to allocate sufficient funds for cybersecurity.
African governments must develop, implement and regularly update national cybersecurity policies and strategies, involving a wide range of stakeholders in the process.
Establishing a dedicated national institution (Cybersecurity authority) to coordinate cybersecurity activities, respond to cyber incident, monitor threats and help organizations recover from major cyberattacks should be a top priority for governments.
Governments should work on creating and implementing legislation for the protection of personal data. This legislation should combat cybercrime, guarantee the protection of personal data, and maintain the digital security of citizens and organizations.
Regular cybersecurity awareness should be conducted. People should be educated on potential privacy risks when working in virtual environments.
Governments should identify critical information infrastructure, disruption of which could cause non-tolerable events at the level of industries and countries.
Collaboration between governments and industry peers is also recommended to enhance collective defense against cyberattacks and exchange best practices and thoughts.
Organisations should implement best practices in safeguarding personal and corporate data.
Organizations should have an up to date incident response plan that will help in case of cyberattack. The plan should contain steps to take, as well as a list of people and services to reach in case of emergency. This plan should be regularly tested by conducting attack simulations.
Network segmentation might limit an attacker’s exploration of compromised networks. Critical systems in particular should be totally isolated from the rest of the corporate network.
Establishing continuous vulnerability assessment and triage as a basement for effective vulnerability management process
Implementing strict access controls is highly recommended. The principle of least privilege should always be in use for any resource. Multifactor authentication should be deployed wherever possible.
Mr Yusuph Kileo is an award-winning Cyber security and Digital Forensics Expert
E-Business
NDPC Asks Court to Dismiss Meta’s Suit Challenging $32.8m Fine

Nigeria Data Protection Commission (NDPC) has prayed the Federal High Court (FHC) in Abuja to dismiss, in its entirety, a suit filed by Meta Platforms, Inc. challenging the sanctions imposed on it.
The NDPC had, on Feb. 18, imposed both a remedial fee of 32,800,000 million US dollars and eight corrective orders against Meta Inc.
The American multinational technology company was alleged to have violated the fundamental privacy rights of its Nigerian users with respect to behavioural advertising on Facebook and Instagram.
Dissatisfied with the action, Meta Platforms Inc., in a motion ex-parte dated and filed on Feb. 26, dragged the regulatory agency to court as sole respondent.
In the motion ex-parte marked: FHC/ABJ/CS/355/2025 and moved by Fred Onuofia, SAN, on March 4, Justice James Omotosho granted one of the two orders sought.
The judge had granted leave to Meta to commence proceedings by way of judicial-review seeking, inter alia, an order of certiorari quashing the compliance and enforcement orders dated Feb. 18 issued by NDPC against the company, “and all other investigations, proceedings and actions taken by respondent against the applicant leading to the ‘Final Orders.’”
He, however, refused to grant Meta’s relief seeking a stay of the proceedings of all matters relating to the “Final Orders” issued by NDPC against it, pending the hearing and determination of the judicial review proceedings.
Instead, the judge made an order of accelerated hearing of the suit.
The firm, in its originating summons filed by Prof. Gbolahan Elias, SAN, lead counsel, wants the court to determine whether NDPC’s investigative process and ensuing compliance and enforcement orders (the Final Orders) issued on Feb. 18 were invalid, null and void.
Meta, in its application dated and filed March 19, hinged the question on the allegation that the commission failed to provide it with adequate notice or an opportunity to be heard on alleged violations of the NDP Act prior to issuing the “Final Orders.”
Meta argued that such action violated its due process rights, including its right to fair hearing under Section 36 of the 1999 Constitution (as amended), among other reliefs.
But NDPC, in a preliminary objection to Meta’s suit, told the court that the suit is incompetent and the court lacks the jurisdiction to entertain same.
The regulatory agency, in its application dated April 10 and filed April 11 by Adeola Adedipe, SAN, its lawyer and the head, ALPHA & ROHI Law Firm, urged the court to either strike out or dismiss the case.
Adedipe, in two grounds of argument, submitted that the originating summons filed by the company is incompetent for non-compliance with the mandatory provision of Order 34 Rule 6(1) of the FHC (Civil Procedure) Rules, 2019.
Quoting the provision, the lawyer said: “No ground shall be relied upon or any relief sought at the hearing, except the grounds and reliefs sought in the statement.”
He also argued that the suit, as presently constituted, is grossly incompetent and academic, the reliefs sought therein, not being capable of activating the jurisdiction of the court.
“The suit is liable to be struck out/dismissed, in limine,” Adedipe argued.
The NDPC, in the affidavit attached to the preliminary objection, stated that by an ex-parte motion, Meta Inc. filed the case.
The commission said that the company had filed the suit, seeking leave to apply for judicial review against the decision of the respondent taken on Feb. 18.
It averred that there was a statement made pursuant to Order 34 of the Rules of the court, supporting the said application, containing the company’s two reliefs.
It said the court granted permission on March 4 for Meta to commence the proceeding, by way of judicial review.
According to the respondent, the originating summons filed by the plaintiff was commenced on 19th March, 2025, 15 days after leave was granted for the judicial review proceedings to be commenced.
NDPC, however, contended that the reliefs contained in the originating summons were completely different from the reliefs contained in the statement filed to support the ex-parte application for judicial review.
It said it believes that this error on the part of Meta was fundamental and “the defendant/applicant (NDPC) does not intend to waive its right to object, in this regard.”
“The defendant/applicant does not intend to waive its rights in challenging these fundamental errors, which are fatal to this proceeding and jurisdiction of the court.”
The commission said it would be in the interest of justice for its objection to be sustained.
Also, in a counter affidavit deposed to by Osunleye Olatubosun, NDPC ‘s staff, in opposition to the originating summons filed by Meta on March 19, he said the suit was brought under the judicial review procedure, primarily, to contest the decision of his office against Meta.
Olatubosun averred that in the NDPC ‘s decision, Meta was sanctioned after a protracted and thorough process of investigation.
He said the investigative power of the commission was activated by a petition written by an organisation, the Personal Data Protection Awareness Initiative (PDPAI).
The PDPAI had alleged that the company breached the data protection rights of users of Facebook and Instagram.
He averred that in the said petition, the plaintiff was alleged to be engaging in behavioural advertising without obtaining explicit consent of data subjects (users).
He said compelling evidence were provided in support of the petition, revealing Meta’s private policy showing that it conducted behavioural advertising, without obtaining consent from the data subjects.
The officer, in the counter affidavit dated and filed on April 30, described behavioural advertisement as “a special form of targeted advertising, where consumers are shown advertisements based on their behavioural data.”
He said it is a kind of advertising which collects and tracks individual sensitive information, without their knowledge or consent, to either share with third parties, or to decide specialised advertisements to be shown to the consumers.
Olatubosun said during investigation, NDPC drew the company’s attention to some very disturbing violations in this regard, especially as to non-consensual data processing activities.
He said these included the disclosure of sensitive personal data of minors relating to their sex lives; sensitive personal data of minors involving drug use; and sensitive personal data of minor pupils in school, involving erotic dancing.
He said it also revealed sponsored advertisements on gambling, involving the manipulated personal data of a female journalist on TVC; sponsored advertisement on gambling involving the manipulated personal data of a male journalist on Channels; and manipulated personal data of public figures, conspiring to commit a felony; explicit video of a woman delivering a child, with her genitals in full display, etc.
He said Meta was, therefore, found in breach of certain provisions of the Nigeria Data Protection (NDP) Act, and that its promotion of debasing images outside the expectation of concerned data subjects offended the principles of fairness, lawfulness, transparency, accountability and duty of care.
Besides, the officer said failure of the company to file a compliance audit with the commission for the year 2022, was a breach of the NDP Act.
He equally said that cross border transfer of data by Meta, contravened mandatory requirements under the NDP Act.
Olatubosun, who said that it was wrong for the plaintiff to process the data of its non-users of it platforms, added that Meta’s privacy policy violates relevant provisions of the NDP Act.
Against these development, the officer said the commission ordered the firm to, henceforth, “seek express consent of data subjects in Nigeria, where their personal data for behavioural advertising will be process.
“Carry out Data Processing Impact Assessment, taking into account the democratic development of Nigeria; update its privacy policy; cease and desist from transferring data out of Nigeria without approval of the commission, in line with the NDP Act.
“Create an appropriate icon link for educative videos, on the dangers of manipulative, unlawful and unfair data processing; put in place sufficient measures for the protection of data privacy on its platforms; and payment of 32, 800, 000 USD.”
Olatubosun said that the case lacks merit, praying the court to dismiss it.
Meanwhile, other reliefs sought by Meta in the main suit, include whether NDPC’s initiation of its investigation, based on a petition submitted by an organisation, rather than on a complaint filed by a “data subject” (as defined under Section 65 of NDPA), invalidates the investigation and the “Final Orders.”
It also prayed the court for an order of certiorari, quashing the investigation, all proceedings constituted thereby, as well as the ensuing “Final Orders” issued by the commission against it.
It equally sought an order of injunction restraining NDPC from enforcing or taking steps to enforce any or all of the orders and/or intimidating, harassing or coercing the applicant to pay the purported remedial fee as contained in the “Final Orders.”
However, Meta, in a motion on notice filed on April 23, sought to amend its statement attached to the ex-parte application, having seen through the notice of preliminary objection which was filed by Adeola Adedipe, SAN, on behalf of the commission.
Onuofia, SAN, while adopting all their processes, said the motion sought an order granting leave to the company to amend its statement pursuant to Order 34, Rule 3(2)(a) of the FHC rules.
He said it also sought an order deeming the amended statement, which had already been filed and served on NDPC as having been properly filed and served.
Giving grounds why his application should be grated, Onuofia said on March 4, the court heard and granted their motion ex-parte for leave.
He said, thereafter, Meta filed it originating summons on March 19.
The lawyer, however, told the judge that the firm sought to amend the wording of the reliefs and grounds set out in the statement to replicate the wording used in the originating summons.
He said the decision was to ensure efficiency and the full and fair hearing of the issues arising in the originating summons.
According to him, the proposed amended statement highlights the amendments that the applicant seeks permission to make to the statement.
Onuofia said the requested amendment would not cause any injustice to NDPC.
But Adedipe vehemently opposed Onuofia’s prayer seeking an amendment, urging the court to dismiss the application.
The senior counsel told the court that a counter affidavit was filed on May 2 in opposition to the motion.
He argued that the application was presumptuous and misleading.
He submitted that an amendment of a process is not as of right, but entirely at the discretion of the court, where such is practicable and lawful to do so.
Adedipe argued that the reliefs sought in a statement attached to a judicial review procedure cannot be amended, except the grounds for which the reliefs are premised.
He said the reliefs contained in the statement, are such that must be reproduced in the originating process filed, after leave had been granted for judicial review.
According to him, the applicant seeks to amend the reliefs set out in the unattached predicate “statement.”
“There can be no amendment to incompetent reliefs set out in the statement,” he said.
The lawyer argued that to concede that the reliefs contained in the predicate statement should be amended, was to make a mockery of the entire proceedings as the court had already granted the said reliefs contained in Exhibit A.
‘This is suggestive that the court already determined the substantive suit in favour of the applicant, ex-parte.
“The application before this court is not for ‘substitution’ of the reliefs, but amendment of orders or reliefs which had already been granted in the ex-parte application,” he argued.
He added that what Meta sought to do was to substitute the reliefs, under the guise of amendment.
He said the application contradicted Order 34(6)(1) of the FHC (Civil Procedure) Rules, 2019.
“It projects a lot of incongruity,” he said, arguing that there was no provision under the Rules to amend reliefs in the statement; but that only grounds of the reliefs can be amended.
Justice James Omotosho adjourned the matter until Oct. 3 for consolidated ruling on the preliminary objection and motion to amend.
E-Business
France Moves to Tackle Online GBV in Africa with $4.3m Funding

France has unveiled a $4.3m grant to combat technology-facilitated gender-based violence (TFGBV) against women across Africa and the Middle East.
The multi-million-dollar financial funding being released through the Agence Française de Développement (AFD) will support feminist civil society organisations (CSOs) to fight online gender-based violence such as cyberstalking and image-based exploitation
The initiative, launched under the Support Fund for Feminist Organisations, seeks to finance groups of national, international, and French CSOs over a three-to-four-year period.
The AFD emphasised that these organisations must operate in at least four countries, with three among the most vulnerable, including nations like Zimbabwe, Nigeria, Ethiopia, and Lebanon.
“TFGBV is a digital pandemic affecting millions of women and girls. We need urgent, cross-border solutions that put power back in the hands of women-led organisations,” said the French global aid agency.
Other forms of TFGBV include cyberstalking, sextortion and online harassment. According to the United Nations, 90% of African women internet users have encountered some form of online violence, often deterring their participation in public discourse.
The new AFD funding will focus on capacity-building, policy advocacy, creating safer online spaces, and promoting feminist innovation. Applications are open until August 31, 2025, with a strong emphasis on local leadership.
AFD’s call comes as part of France’s broader feminist foreign policy, which aims to channel 75% of its bilateral aid towards gender equality objectives by the end of 2025.
“Women’s rights cannot be fully realised if digital spaces remain dangerous and hostile,” added the AFD.
Interested CSOs can access the call for proposals on AFD’s website. The selected consortium will design and manage disbursement mechanisms, ensure knowledge exchange across countries, and integrate survivors’ voices into the fight against TFGBV.
France is confident that the new AFD initiative will empower women-led groups in Africa and the Middle East to scale solutions, shape policies, and build safer digital spaces.
E-Business
Olatunji, NDPC Boss Calls for Integrated Strategy on Data Privacy, Cyber-Security

Dr Vincent Olatunji, national commissioner, Nigerian Data Protection Commission (NDPC), has emphasized that data privacy, protection, and cybersecurity are “inseparable pillars of the digital age” and must be prioritized in Nigeria’s digital transformation journey.

Dr Vincent Olatunji, national commissioner, NDPC
Dr. Olatunji made this assertion during his keynote address titled “Data Privacy and Protection: Nigeria’s Roadmap to Compliance” at the ongoing National Cybersecurity Conference in Abuja.
He underscored that while data protection focuses on safeguarding personal information from misuse, cybersecurity protects the systems that store this data. “Data privacy is a basic human right that empowers individuals to control how their personal information is collected, used, and shared,” he said.
“Strong cybersecurity is essential to maintain the confidentiality, integrity, and availability of personal data. Conversely, robust data protection frameworks help guide effective cybersecurity practices and foster a culture of privacy.”
Highlighting Nigeria’s progress, Dr. Olatunji noted the country’s recent Tier 3 (“establishing”) ranking in the 2024 Global Cybersecurity Index and its top position in Africa particularly in the area of data protection. He traced the evolution of Nigeria’s data protection journey, culminating in the signing of the Nigeria Data Protection Act (NDP Act) 2023 by President Bola Ahmed Tinubu (GCFR).
He described the NDP Act as the cornerstone of the country’s data governance framework. “The Act regulates the processing of personal data in Nigeria and guarantees the privacy rights of individuals,” he explained.
It applies to both local and international data controllers and processors handling data of Nigerian subjects and provides clear guidelines on data collection, storage, consent, data subject rights, and penalties for non-compliance.
Dr. Olatunji cited the recent ₦766.2 million fine imposed on MultiChoice for non-compliance as an example of the Commission’s enforcement capacity. He also revealed that the NDPC has generated over ₦2 billion in the last two years, with the data protection sector now valued at ₦16.2 billion alongside the creation of numerous job opportunities.
He further highlighted ecosystem growth, citing the certification of 455 Data Protection Officers (DPOs) under the National Certification Program and verification of 3,343 Data Protection Compliance Organizations (DPCOs) by 2025.
While celebrating progress, Dr. Olatunji also pointed to key areas for improvement, including building institutional capacity, enhancing data literacy and workforce development, and strengthening collaboration across sectors.
In conclusion, he urged stakeholders to “embrace a culture of data protection, implement robust cybersecurity practices, and stay attuned to the evolving regulatory landscape” in order to reduce risks, protect assets, and support long-term national growth.
- E-Financial2 days ago
Zenith Banks Leads as 8 Banks Suffer N156Bn Impairment Charges
- Telecom2 days ago
MTN @ Swish Fusion Summit, Showcases 5G Rollout Strategy
- E-Business2 days ago
Olatunji, NDPC Boss Calls for Integrated Strategy on Data Privacy, Cyber-Security
- Telecom1 day ago
MTN’s ₦31.75Bn Investment in Health Lauded at Arthur Mbanefo Lecture
- News2 days ago
US Launches ‘Window on America’ @ Ogun Tech Hub
- E-Business2 days ago
Kaspersky Experts Warn of the Risks Hidden Behind QR Codes
- E-Financial2 days ago
SEC Flags FF Tiffany as Ponzi Scheme
- News2 days ago
SEC Probes Ponzi Scheme Linked to FF Tiffany