More glitches

The regulator is asleep at the wheel

If you missed last week’s Notadeepdive, catch up here and here.

TOGETHER WITH CREDIT DIRECT

Are you ready for Black Friday?

Enjoy discounts with only a 25% down payment across 500+ merchants this Black Friday, with Credit Direct Checkout.

Check your shopping limit to see how much you qualify for.

More glitches

When a few fintechs were hit by cybercriminals in early October, Lendsqr, the lending-as-a-service startup, went looking for weak spots in its code. Adedeji Olowe, its founder and the chair of Paystack’s board, thought the company was in good shape, but the review found more than 800 problems, some minor and some serious, and Lendsqr spent the next three weeks fixing them.

The cyberattackers began attempting to access Lendsqr on Friday, October 30, while its team was in a meeting about taking a customer live. The second wave began on Sunday night, and Lendsqr only noticed because a member of its security team was up late.

The attackers used stolen developer tokens to go after Lendsqr’s code and guessed at staff passwords. They sent fake payment notifications to see which systems would take the bait. In one case, they logged in with a borrower’s real password, lifted from somewhere else, and got no further than Lendsqr’s device checks. Each time Lendsqr blocked one of their rented servers, they abandoned it and returned to another. Writing on Wednesday, Olowe said they were “escalating by the hour.”

Lendsqr lost no money and no data, and that is more than several other fintechs can say. People familiar with the incidents say attackers took a little over ₦3.5 billion from one major fintech this week. Another lost ₦1 billion. At a third, a month of attacks has cost the company about $300,000.

I’m leaving these companies unnamed because naming only the companies whose losses I’ve been able to pin down would give you a skewed picture of how widespread this is.

People with knowledge of the incidents tell me none of these attacks I’m reporting today, or those I wrote about in Hitches and Glitches, have been reported to the Nigeria Data Protection Commission.

Section 40 of the Nigeria Data Protection Act gives companies 72 hours from becoming aware of a personal data breach to notify the commission if the breach is likely to put people’s rights and freedoms at risk. When the risk is high, companies must inform the affected people immediately.

I don’t know whether the attackers who took ₦3.5 billion also got into customer records. Has the NDPC asked? How many of the companies hit since October has it contacted, and how many have warned customers?

In Hitches and Glitches, I worried that regulators and the companies they oversee would start treating breaches as private affairs. This wave raises a simpler question. How much of what’s happening does the commission even know about?

When attackers took about $6.3 billion from Binance on October 29, the exchange disclosed the breach that night and worked with other companies to freeze the stolen funds. By November 3, Binance disclosed the amount frozen or intercepted at $2.85 billion. Binance’s account of the attack was more useful than the first headlines about a compromised laptop. The attackers had stolen one engineer’s credentials and used them from another engineer’s computer to reach systems that could move money; that’s the sort of detail another company can take back to its own security team.

Lendsqr had already heard that other companies had been hit, but a more useful warning would have been about the stolen GitHub tokens. Many of the fixes the team made after the attacks started could have been in place weeks earlier.

Once Lendsqr saw how the attackers were getting in, it went back through six years of developers who had worked with the company and asked them to revoke their tokens and check their machines.

A developer who has worked for several fintechs may still have access to several of them. By the time everyone on WhatsApp knows which company got hit, the other security teams may still have no idea which credentials to kill.

This is not the first time there’s been an argument for fintechs to share information to combat fraud and bad actors just like the banks do; in March 2023, days after reports that Flutterwave had lost ₦2.9 billion to hackers, which it denied, more than a dozen fintechs started planning Project Radar, a shared registry of fraudsters.

Flutterwave’s chief executive, GB Agboola, took the lead, but it’s unclear where those efforts went despite its change of name in 2024 to Reporta. One of the skeptics Semafor Africa quoted at the time was Olowe, who said Nigerian fintechs “mostly talk but never collaborate”. He predicted that when it came time to hand over data, companies would start citing their privacy policies.

To be fair, even project Radar’s early members weren’t sure whether the law would allow them to pool customers’ details without a privacy regulator’s approval. The NDPC can end that doubt by clarifying what companies may share with one another when they’re attacked.

Until fintechs start talking to each other, the only people in this industry learning from every attack are the attackers.

If you know someone who runs engineering, risk or compliance at a fintech, send them this edition.

OPay’s China problem

Last week, we shared two theories about why OPay suspended its IPO. A Bloomberg report now suggests it was the second one: OPay halted the IPO hours after pricing it because of inquiries from a Chinese regulator, even though it has no operations or revenue in China. Bloomberg also reports that CICC, the Chinese bank we noticed was missing from OPay’s pricing announcement, had been taken off the deal.

I’ll be back on Sunday with more on OPay. Subscribe to get that edition in your inbox.

One thing to watch.

Our YouTube video on how newspapers have almost become obsolete has now been watched over 600 times, which I’m taking as encouragement to put more of these videos into the world. I’ve shared previously that the video format is one I plan to experiment with a lot more this year, so prepare to be sick of me.

Anyway, I’ve been seeing a ton of Nollywood movies on YouTube these days so I searched far and wide and got a Nollywood veteran to walk us through the economics of these videos. It’s really fascinating stuff. Watch it here and let me know what you think!

If you’d like more reporting like this, tap the heart on this edition.