INTRODUCTION
Ransomware has become a significant threat globally and in
Nigeria. The burgeoning digital economy of Nigeria has seen a surge
in cybercrime. With the rise of digital transactions, increased
internet penetration, and reliance on online services, businesses,
public & private institutions have become more vulnerable.
According to the Nigerian Communications Commission (NCC), Nigeria
has lost $500 million to cybercrime attacks1. Deloitte
likewise notes that 2024 saw an unprecedented increase in cyber
threats, with no sector immune to ransomware2. According
to the International Criminal Police Organisation
(INTERPOL)3, Nigeria was even ranked third in Africa
(after Egypt and South Africa) for ransomware detections in
2024.
While ransomware poses technical and financial challenges, its
implications extend into the legal and regulatory sphere. These
trends underscore the urgency of understanding Nigeria’s legal
and regulatory framework for ransomware. Nigerian laws impose
duties on organisations to protect data, secure networks, and
report breaches.
This article examines the legal risks, regulatory obligations,
and compliance requirements that Nigerian businesses must address
when confronted with ransomware.
UNDERSTANDING RANSOMWARE IN THE NIGERIAN CONTEXT
Ransomware is malicious software that either encrypts an
organisation’s data or locks users out of systems and then
demands payment to restore access4. In Nigeria, the
mechanics are the same as elsewhere, but the environment in which
attacks succeed has particular features that shape how
organisations should think about the threat.
Attackers commonly gain a foothold through human error or
unpatched technical flaws: phishing emails that trick staff into
opening malicious attachments or links, weak or reused passwords,
and systems that have not received security updates5.
Increasingly, ransomware is offered as a service: criminal groups
develop and lease ready-made ransomware toolkits to affiliates,
lowering the technical barrier and widening the pool of
attackers.
Beyond the technical fallout, ransomware poses legal and
regulatory problems for victims: data breaches can trigger
mandatory reporting duties, contractual liabilities to clients and
partners, and scrutiny from sector regulators such as the Nigeria
Data Protection Commission (NDPC/NITDA) and the Central Bank of
Nigeria. For example, banks under CBN supervision must report
cybersecurity incidents (including ransomware) to the CBN within 24
hours6.
LEGAL RISKS ASSOCIATED WITH RANSOMWARE
The legal consequences of ransomware attacks in Nigeria extend
far beyond the immediate operational disruption. They expose
organisations, executives, and even third-party service providers
to criminal, civil, and regulatory liabilities under multiple legal
instruments.
1. Criminal Liability:
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as
amended) provides a comprehensive legal framework that
criminalises a wide range of conduct linked to ransomware, from its
creation and sale to its use in extortion or data
destruction7. The law makes it an offence to knowingly
develop or distribute any malicious software, such as a virus,
Trojan, or ransomware, that causes damage to computer systems or
data. Conviction for such conduct attracts imprisonment or a
monetary fine, underscoring the gravity with which Nigerian law
views cyber threats8.
Beyond the direct act of spreading ransomware, related offences
are also punishable. Unauthorised access to computer systems,
commonly the first step in deploying ransomware, is a distinct
crime under the Act9. Similarly, interfering with or
manipulating data, such as encrypting files to deny access, is
prohibited and carries significant penalties.10 The law
also criminalises extortionate communications made through computer
systems (including ransom demands) that threaten to destroy or
expose stolen data unless payment is made.11
2. Civil Liability:
Organisations targeted by ransomware may also face civil
liability for the consequences of a breach. Under the principle of
tort law, companies are obligated to exercise a general duty of
care to safeguard the personal and financial data of their clients,
employees, and business partners. When a ransomware attack occurs
due to inadequate cybersecurity measures, affected individuals or
entities may bring legal action for negligence, breach of contract,
breach of fiduciary duty or breach of privacy12. To
succeed, a claimant must typically show that the organisation
failed to implement reasonable safeguards and that this failure
directly caused loss or damage.13
Legal practitioners in Nigeria have observed that courts are
increasingly receptive to such claims, particularly where
“inadequate safeguards or reckless handling” of personal
or sensitive data leads to identity theft, reputational damage, or
financial harm14 For instance, a financial institution
that fails to maintain adequate cybersecurity controls or to
encrypt customer data may be held liable for negligence or for
breaching contractual obligations of confidentiality. Although our
body of case law on ransomware-related suits is still developing,
traditional principles of tort and contract law remain applicable:
a company can be held accountable for foreseeable harm resulting
from its failure to secure its systems or uphold data protection
commitments.
3. Regulatory Liability and Fines:
Beyond lawsuits, organisations in Nigeria also face statutory
penalties for data security failures. Under the Nigeria Data
Protection Act 2023 (NDPA) and the earlier Nigeria Data
Protection Regulation 2019 (NDPR), data controllers and
processors are required to implement appropriate technical and
organisational measures to safeguard personal data. Failure to
comply can attract significant fines.
Aside from the Cybercrime Act 2015, sector-specific regulations
also impose sanctions on institutions under their supervision for
failing to meet prescribed cybersecurity and reporting
standards.
4. Corporate / Reputational Risk:
Even where litigation or regulatory fines do not occur,
ransomware can cause serious business consequences. Public
disclosure of a data breach can undermine customer confidence and
severely damage brand reputation15. In highly regulated
industries, such incidents may attract heightened regulatory
scrutiny. Authorities could mandate compliance audits, impose
corrective orders, or, in extreme cases, suspend operating licences
if security lapses persist16.
Also read: Online Safety & Cybercrimes: Navigating
Nigeria’s Cybersecurity Compliance And Safety Laws
REGULATORY DUTIES IMPOSED ON ORGANIZATIONS
-
Data Protection Obligation:
The Nigeria Data Protection Act 2023 (NDPA), together
with its implementing instrument, the Nigeria Data Protection
Regulation 2019 (NDPR), imposes strict obligations on all
persons and entities that process personal data. Under the
Act17, Data controllers and processors are required to
implement appropriate technical and organisational measures to
ensure the confidentiality, integrity, and availability of personal
data. This provision aligns with Article 32 of the European Union
General Data Protection Regulation (GDPR) and establishes a
positive duty on data controllers and processors to proactively
maintain robust data security measures.
Where a ransomware incident results in unauthorised access,
encryption, or loss of personal data, the affected data controller
must notify the Nigeria Data Protection Commission (NDPC) within 72
hours of becoming aware of the breach, especially where it is
likely to pose a risk to individuals’ rights and
freedoms18. If the breach presents a high risk, for
instance, exposure of sensitive or financial information, the NDPA
further requires that the affected individuals be informed without
undue delay19.
Failure to comply with the Security and notification
requirements of the NDPA may attract the statutory penalties
outlined earlier, including fines of up to 2% of annual gross
revenue or ₦10 million20. Organisations that
collect or process personal data in Nigeria must observe the NDPA
and NDPR breach reporting and data security obligations, even where
the breach stems from a criminal ransomware attack.
More broadly, the Cybercrimes (Prohibition, Prevention, etc.)
Act 2015, as amended by the Cybercrimes (Amendment) Act 2024,
establishes national obligations for reporting cyber incidents.
Under the amended Act, any person or organisation that becomes
aware of a cyberattack or significant threat is required to notify
the National Computer Emergency Response Team (ngCERT) immediately,
and not later than 72 hours after detection.21
In practice, affected businesses often also involve law
enforcement or economic crime agencies (e.g the Nigerian Police
Cybercrime Unit or the EFCC) to pursue attackers. Together, these
rules mean that data breaches and ransomware attacks must be
quickly escalated to regulators and law enforcement in Nigeria.
-
Sector-Specific Cybersecurity
Obligations:
Beyond general data protection laws, industry-specific
regulations impose additional cybersecurity obligations on
regulated entities. For instance, the Central Bank of Nigeria (CBN)
issued the Risk-Based Cybersecurity Framework and Guidelines
(2024) for Deposit Money Banks and Payment Service
Banks22 mandates institutions to establish robust
cybersecurity governance structures, conduct periodic risk
assessments, and report cybersecurity incidents to the CBN.
Notably, the guidelines require banks to report any cyber incident
to the Central Bank within 24 hours of detection. Furthermore,
banks are required to appoint qualified Chief Information Security
Officers (CISOs) and ensure board-level oversight of cybersecurity
risk management.
Similarly, the Nigerian Communications Commission (NCC) imposes
cybersecurity obligations on telecommunications operators. Under
its various regulatory instruments, Internet Service Providers
(ISPs) are required to publish acceptable-use policies and
cybercrime awareness notices to their subscribers. Failure to
comply may attract regulatory or criminal
sanctions23.
PRACTICAL CHALLENGES IN ENFORCEMENT AND COMPLIANCE
Nigeria faces several challenges in enforcing cybersecurity laws
and achieving compliance:
- Limited enforcement capacity. Nigerian law
enforcement and regulatory agencies are still building expertise.
The cross-border and anonymous nature of ransomware gangs (often
abroad) makes prosecution difficult. As a result, relatively few
attackers are brought to justice, which can embolden criminals.
Meanwhile, many victims hesitate to report attacks, fearing
reputational harm, so incidents are likely undercounted. - Regulatory overlap and uncertainty. Multiple
agencies have mandates in cyberspace, and their roles sometimes
overlap. The United Nations specialised agency for information and
communication technologies (UN ITU) has noted that Nigeria should
“streamline the regulatory functions” of bodies like the
National Information Technology Development Agency (NITDA) and the
National Communications Commission (NCC) to avoid
duplication24. In practice, organisations may find
themselves subject to fragmented rules (for example, having to
satisfy both data-protection and telecom regulations). This
complexity can hinder clear compliance. - Economic constraints. Budgetary pressures make
it hard for some businesses to invest in top-tier security.
According to Deloitte, cost sensitivity may drive firms to adopt
untested “indigenous” security solutions that have not
undergone rigorous vetting, introducing new
vulnerabilities.25 In other words, in a strained
economy, affordable fixes may prove insufficient or even
risky. - Rapidly evolving threats. Cybercriminals
continually develop new techniques (for instance, using AI to
automate attacks) faster than some regulations can adapt.
Organisations may struggle to keep pace with both technology and compliance requirements. By the
time new laws or guidelines are issued, attackers may already have
found a workaround. - Awareness and culture. Finally, many Nigerian
businesses (especially smaller firms) still underappreciate the
legal stakes of ransomware. There is a need for more education of
boards and executives to treat cyber-risk as a board-level issue.
The gap in cybersecurity expertise in Nigeria’s workforce can
also hamper compliance. These human factors from top management
down to employees, present ongoing enforcement challenges that
technical rules alone cannot solve.
RECOMMENDATIONS FOR NIGERIAN BUSINESSES AND INSTITUTIONS
To mitigate ransomware risk and meet Nigeria’s legal
requirements, organisations should adopt a comprehensive
approach:
- Strengthen technical defences: Keep all
systems and software patched promptly; apply security updates and
patches as soon as they are available. Use reputable licensed
software (avoiding “cracked” programs) and deploy
anti-malware tools. Enable multi-factor authentication and strict
access controls. Encrypted backups are crucial: maintain offline or
off-site copies of critical data, so that systems can be restored
without paying a ransom. As noted by experts, measures like prompt
patching, intrusion detection systems, and avoiding unauthorised
software are essential to blunt ransomware threats. - Implement data protection practices: Classify
and encrypt sensitive personal and corporate data. Ensure
compliance with Nigeria’s data laws: register with NITDA if
required, obtain lawful consent for data processing, and have clear
privacy policies. Prepare to fulfil breach-notification
obligations: assign a data protection officer or security officer
to monitor for breaches. In the event of an attack, follow the
mandated reporting timelines. - Governance and culture: Embed cybersecurity
into corporate governance. The board and senior management should
own the cyber strategy (as required by CBN guidance -appoint a
qualified Chief Information Security Officer and ensure employees
at all levels receive regular training on phishing, social
engineering, and incident response procedures. Establish an
incident response plan and conduct drills so staff know exactly
what to do if ransomware strikes. - Incident preparedness and response: Develop a
formal incident response framework. Coordinate with sectoral
Computer Emergency Response Teams (e.g. NCC-CSIRT, FinCERT) and law
enforcement in advance. Cyber-insurance can be considered to cover
residual risks and recovery costs (some analyses specifically
recommend adding insurance to the defence toolkit26. In
any attack, isolate infected systems immediately, engage forensic
experts, and involve the National Computer Emergency Response Team
(ngCERT) and relevant regulators without delay.
CONCLUSION
Ransomware poses both technological and legal challenges for
Nigeria. The law treats ransomware creation and deployment as a
crime and holds organisations to high standards of data protection
and cybersecurity. Compliance requires a coordinated effort:
companies must implement strong security measures, fulfil breach
notification duties, and work with regulators. Nigerian
institutions have made important strides – enacting the
Cybercrimes Act and the Data Protection Act, issuing sectoral
guidelines, and launching a National Cybersecurity Policy –
but enforcement remains a work in progress. Going forward,
strengthened enforcement, clear regulatory roles, and corporate
vigilance will be key to managing ransomware risk. As one legal
analysis observes, data breaches “are not merely technological
challenges but legal risks with far-reaching consequences,”
and addressing them demands both robust laws and proactive
corporate governance. For businesses, compliance is not just a
regulatory burden but a necessary component of trust, continuity
and sound governance in Nigeria’s digital economy.
Footnotes
1. Temitayo Jaiyeola, ‘Hackers’ attacks surge
against Nigerian tech companies’ business day newspaper (Lagos
July 10 2024)4
2. Deloitte Nigeria, Nigeria Cybersecurity Outlook
2025 (2025) (“Outlook Report”). https://www.deloitte.com/ng/en/services/consulting-risk/perspectives/Nigerias-cybersecurity-landscape-in-2025.html
3. Nigeria ranks third in Africa for ransomware
threat detections in 2024 – INTERPOL”, Extensia (30
June 2025) — https://extensia.tech/nigeria-ranks-third-in-africa-for-ransomware-threat-detections-in-2024-interpol/
4. Ayinla TA, Oyelakin OO and Olomu A, ‘A
Comprehensive Review on Machine Learning Techniques for the
Identification of Ransomware Attacks in Computer Networks’
(2024) LAUTECH Journal of Computing and
Informatics.
5. ngCERT, “Escalation of Ransomware Attack in
Nigeria” (Advisory, 8 July 2024). https://cert.gov.ng/index.php/advisories/escalation-of-ransomware-attack-in-nigeria
6. Central Bank of Nigeria (CBN), Risk-Based
Cybersecurity Framework and Guidelines for Deposit Money Banks and
Payment Service Banks (Issued 31 May 2024). Available: hIndividualsttps://www.cbn.gov.ng/Out/2024/BSD/CBN%20Risk-Based%20Cybersecurity%20Framework%20for%20DMBs%20and%20PSBs_2024.pdf.
7. See section 32(3) Cybercrimes (Prohibition,
Prevention, etc.) Act 2015 (as amended), see also ICLG –
Cybersecurity Laws and Regulations: Nigeria (2024) https://iclg.com
8. Ibid.
9. See section 6, Cybercrimes (Prohibition, Prevention,
etc.) Act 2015 (as amended).
10. Ibid, section 12, Cybercrimes (Prohibition,
Prevention, etc.) Act 2015 (as amended).
11. Ibid, section. 24; Nigerian Financial
Intelligence Unit (NFIU), Cybercrime and Extortion Reporting
Framework (2023), available at https://nfiu.gov.ng.
12. See also, Incorporated Trustees of Digital Rights
Lawyers Initiative v LT Solutions & Multimedia Limited,
Unreported Judgement of the High Court of Ogun State, Abeokuta
Judicial Division, Coram Hon. Justice O. Ogunfowora, delivered on
the 9th day of November 2020 in Suit No. HCT/262/2020. The court
held that right to privacy extends to protection of a citizen’s
personal data.
13. A.O.C. Solicitors, “Cybersecurity Risks
and Corporate Liability in Nigeria” (2024), available at https://aocsolicitors.com.ng, See also,
Incorporated Trustees of Digital Rights Lawyers Initiative v LT
Solutions & Multimedia Limited, Unreported Judgement of the
High Court of Ogun State, Abeokuta Judicial Division, Coram Hon.
Justice O. Ogunfowora, delivered on the 9th day of November 2020 in
Suit No. HCT/262/2020.
14. See also Section 40–42, Nigeria Data
Protection Act 2023, (imposing duties on data controllers to
protect data and report breaches).
15. Ibid, n 17.
16. Ibid, n 17.
17. See section 39 (1), Nigeria Data Protection Act
2023.
18. See Section 40 (1), (2), Nigeria Data Protection Act
2023.
19. See Section 40 (3), Nigeria Data Protection Act
2023.
20. See Section 48, Nigeria Data Protection Act
2023.
21. See section 21(1), Cybercrimes (Prohibition,
Prevention, etc.) Act 2015, as amended by the Cybercrimes
(Amendment) Act 2024.
22. Ibid, N 9.
23. ICLG – Cybersecurity Laws and Regulations:
Nigeria (2024) https://iclg.com
24. Techpoint Africa, “United Nations’
telecom union advises Nigeria to clarify NCC and NITDA
roles”, (6 August 2024), available at: https://techpoint.africa/2024/08/06/un-telecom-nigeria-ncc-nitda.
25. Ibid, n 2.
26. Ohakwe, Chiamaka, The Rise of Ransomware Attacks in
Nigeria (January 18, 2025). Available at SSRN: https://ssrn.com/abstract=5277510 or http://dx.doi.org/10.2139/ssrn.5277510
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
