Global tech media publication Rest of World faces the prospect of a shutdown. It’s an unfortunate development which makes Friday’s Notadeepdive on the tenuous nature of media businesses required reading.
TOGETHER WITH CREDIT DIRECT
Your next big move deserves the right support. 🚀
From personal finance to business funding and flexible shopping, Credit Direct helps you move closer to your goals.
Join us at Moonshot, 28–29 October 2026.
HITCHES AND GLITCHES
On July 26, an extortion group calling itself ExfilSquad claimed it had breached more than a dozen organisations in one day. The list was a rollcall of household names who now had egg on their faces: Microsoft, Allstate, Frontier Airlines and the UK Department for Education. But the name that mattered most in Nigeria was Zenith Bank, one of the country’s big 5 commercial banks. ExfilSquad claimed to have made off with 90 million records from the bank.
It took Zenith Bank nine days to tell customers that there had been unauthorised access to “limited customer information,” including email addresses and phone numbers. The incident was “part of a broader, global cyber-attack targeting multiple international organisations across various sectors,” the bank said.
Say what you will about Zenith’s response, but at least it sent an email trying to ressure customers.
Months earlier, Sterling Bank had been named by another attacker, ByteToBreach, who published material from the bank’s systems.
Where the bank maintained a studied silence, the hacker was loquacious. According to cybersecurity researcher David Odes’ reconstruction, the attacker gained access through a server running software with a known vulnerability for which a fix already existed. He spent roughly nine days inside, examining internal systems and application code, before publishing evidence of his access.
In April, the Nigeria Data Protection Commission (NDPC) completed an investigation into Sterling and issued a decision that has not been made public. What did the investigation find? What did the NDPC require the bank to fix? How could customers know if their information was out in the open and how could they seek recourse?
These omissions have serious consequences. A customer who has not been told about a breach cannot take even the basic precautions available to them like treating messages from the bank with suspicion, changing compromised credentials or watching for attempts to use their identity.
Nigerian law gives the NDPC the power to order compensation for people harmed by a violation and also allows them to sue. Both remedies are considerably harder to pursue when the bank and its regulator know the outcome of an investigation and the customer does not.
In the United States, a breach at Equifax led to a settlement that created a fund of up to $425 million for affected consumers, alongside credit monitoring and identity-restoration services. In Sterling’s case, the public announcement and regulatory process reached a conclusion that was silent on what it means for customers. The danger in Nigeria is that we’re setting a precedent where data breaches become a private matter between the institution and its regulator.
In September, Nigerian organisations faced an average of 5,740 cyberattack attempts each week, more than twice the number recorded a year earlier, data from Check Point showed. It’s difficult to establish the number of successful attacks, especially when the companies being attacked prefer silence.
Three cybersecurity professionals I spoke to confirmed cyberattacks at three prominent fintechs, a bank, an oil and gas company and at least three other technology startups this year. None of the incidents has been publicly disclosed.
We have spent years hearing that AI will make everyone more productive, and there is no reason criminals should be excluded from this general improvement so I expected artificial intelligence to be front and center of how cybercriminals are increasing their success rate.
Using OpenAI’s models, researchers discovered that a vulnerability in PHP, the programming language behind about 70% of the world’s websites, had been there for 14 years. The US National Security Agency and Nigeria’s NITDA advised organisations to update PHP and to take any system they couldn’t update offline until it was fixed.
While AI allows criminals to find old holes faster, it has not made human beings obsolete; the human element was present in 62% of breaches, recent data from Verizon shows.
After companies money spend a great deal of money on firewalls, scanners and security dashboards, most breaches continue to involve a person doing something the attacker needs them to do, like clicking a link on a scammy email.
Of the $3.05 billion lost to business email compromise in the US, just $30 million involved AI. Ironically, what also stops these scams is a human being on the paying side who notices that something’s off and asks questions.
Cybersecurity vs compliance
Has there been any career path that has been as popular as cybersecurity in the last five years? So what are all these people being hired to do and why do these attacks keep happening?
“A lot of cybersecurity people are just compliance analysts,” one of the professionals I spoke to told me. In his experience, much of that work involves documenting controls, preparing for audits and checking what the security tools flag.
Monitoring is then often outsourced to firms that detect incidents and send alerts; unfortunately, most of those alerts are also false positives so when an actual intrusion happens, the network and infrastructure engineers are called in to investigate and clean up.
Compliance is necessary work, but a company also needs people who can establish that an employee’s mailbox has been hijacked, revoke the attacker’s access and work out what they did while inside. Preferably before the attacker gives an interview about it.
See you on Friday! Before you run off, watch our first video: