From Data Leaks to Cloud Exposure: Digital Encode Warns Nigeria’s Organisations of Critical Cybersecurity Gaps

Digital Encode Limited, a leading firm specialising in information security and governance, risk, and compliance (GRC), has issued an urgent cybersecurity advisory following a surge in security breaches impacting financial institutions, government agencies, fintechs, and other organisations across Nigeria.

Cyber threat actors have recently exposed data purportedly from both private and public institutions, highlighting the urgent need for stronger cybersecurity frameworks, proactive threat monitoring, and coordinated incident response strategies.

However, Digital Encode’s advisory reveals a concerning trend: most recent cyber incidents are not driven by sophisticated zero-day exploits but by preventable vulnerabilities in basic security configurations, credential management, and operational controls.

According to the advisory signed by Professor Obadare Adewale Peter, Chief Visionary Officer of Digital Encode Limited, attackers are increasingly exploiting misconfigured systems and publicly exposed assets, such as unsecured databases, open cloud storage buckets, leaked API keys, and critical servers exposed to the internet—many of which are easily discoverable through open repositories, cloud indexing tools, and even dark web marketplaces.

The advisory highlights several critical areas of concern, including:

• Publicly accessible cloud storage exposing sensitive customer and operational data
• Hardcoded secrets in web and mobile applications, including API keys and tokens
• Leaked credentials in repositories and deployment artefacts
• Weak internal access controls and over-reliance on single authentication layers
• Exposure of administrative endpoints, API documentation, and development environments in production
• Uncontrolled use of third-party hosting platforms such as Vercel, Netlify, and Render
• Poor token lifecycle management and weak authentication mechanisms
• Inadequate vendor risk management and monitoring controls

Digital Encode observed that these vulnerabilities are widespread across organisations, especially within financial institutions, payment service providers, fintech firms, and public sector platforms, where similar exposure patterns recur.

Not a Technology Problem, But an Execution Gap

“Organisations affected in recent breaches were not compromised due to highly advanced attacks, but due to lapses in enforcing existing security controls, like, ensuring that no cloud resources linked to organisations whether AWS S3, Azure Blob, Google Cloud Storage, or Firebase allow anonymous access, verify that no cloud credentials or API tokens are exposed in public or private repositories, container registries or deployed applications, and that all external and internal APIs enforce authentication and authorisation controls at all times,” stated Prof. Obadare.

The advisory emphasises that most of these risks can be mitigated with readily available tools and best practices, highlighting a critical gap between security policy and execution.

Urgent Actions Recommended

Digital Encode urges organisations to act immediately by conducting a comprehensive audit of all internet-facing assets, including third-party systems; revoking and rotating all exposed or potentially compromised credentials such as passwords, API keys, and access tokens; reviewing historical logs to assess the extent of prior exploitation; engaging vendors to address third-party security exposures; fixing identified misconfigurations and validating remediation efforts; strengthening monitoring, logging, and threat detection systems; and documenting remediation steps and residual risks for governance and compliance.

The firm also stresses the importance of improving visibility into shadow IT and unauthorised deployments linked to employees’ accounts, which increasingly serve as entry points for attackers.

Call for a Proactive Security Posture

Digital Encode reaffirmed its commitment to supporting organisations through enterprise-wide security assessments and independent validation of implemented controls.

“We strongly advise that this advisory be actioned without delay,” Prof. Obadare warned, adding that proactive security hygiene, not reactive response, will determine resilience in Nigeria’s evolving threat landscape.