Nigeria’s biggest cyber risk may be its small businesses—FoubsLabs Founder

In late 2013, an intrusion quietly took shape inside the network of Target, one of America’s largest retailers.

The breach ultimately exposed the payment card data of roughly 40 million customers and personal information belonging to about 70 million people.

It began when hackers targeted and compromised Fazio Mechanical Services, a Pennsylvania-based refrigeration and HVAC contractor that provided services to Target and had legitimate access to its systems for electronic billing, contract submission and project management.

Hackers stole the credentials Fazio used to access Target’s systems. They then used those credentials to gain a foothold in Target’s network and move deeper into the retailer’s systems, eventually reaching its payment environment.

Fazio never processed any Target transactions. It simply had legitimate third-party access to Target — and that access proved to be enough for the hackers to get inside.

More than a decade later, that story has become one of cybersecurity’s classic lessons in third-party risk: a company’s defences are only as strong as the least-defended business connected to it.

What has changed since 2013 isn’t the lesson; it’s how cheap and fast it has become to find that weak door. And Nigeria, with an economy increasingly built around small businesses connected to much larger institutions, has particular reason to pay attention.

To unpack what that means for Nigeria and the wider continent, Nairametrics spoke with Jephte Ioudom, an AI expert and founder of FoubsLabs, a data analytics and software engineering consultancy.

• “One unprepared company becomes a systemic risk for everyone connected to it,” Ioudom says.

He isn’t talking about Target. He’s talking about Nigeria and Africa, and about a pattern he’s watched play out often enough to describe from memory.

The weak link economy

Ioudom doesn’t treat African businesses as uniformly exposed.

• “I won’t put all African companies in one bucket, as that would be dishonest. There’s a spectrum,” he says.

At one end, Ioudom explains, sit large banks, telcos and tier-one fintechs, which have built real cybersecurity maturity — rules, training, escalation processes, and increasingly AI-driven detection of their own. But even that maturity, he warns, was built for an older threat model.

Training staff to spot a badly written phishing email or verify a request with a phone call “is exactly what AI defeats, as it can now write flawless localised messages and clone voices,” he says.

So even the well-defended have to keep re-tooling just to stay where they are.

At the other end sits much of Nigeria’s economy: MSMEs and smaller fintechs with “little or none” of that infrastructure. According to him, these businesses are often the weak links in the chain and among the least prepared for sophisticated attacks.

• “They are genuinely unprepared, and attackers know it,” Ioudom says. “They deliberately target the weakest link, then use a compromised account there to reach better-defended institutions.”

Understanding how that process actually unfolds helps explain why the risk is so hard to contain.

The anatomy of an attack

Asked to walk through exactly how an attacker could use a compromised business to reach a larger institution, Ioudom outlined the mechanics of a third-party breach.

Picture, he says, a large African financial institution with a strong security team and real defences in place. Most attackers already know that direct intrusion will be hard, so they don’t usually try.

• “Instead, attackers often look for the softest connected point, which can be a small services or hardware vendor with no security team, a small fintech partner plugged into the payment rails, or a forgotten, under-secured server on the edge of the network that the organisation long stopped paying attention to. Every large institution has one of these,” he says.

From there, the attacker slips in, stays hidden for days or weeks, and moves deeper — until they reach the system or the downstream payment platform that was the real target all along.

• “A single overlooked entry point can cascade into hundreds of thousands of exposed customer records,” he says.
• “The attacker maps the ecosystem, finds the party with the least protection, compromises it, then moves laterally on the trust and access that party already carries.
• “To the bigger institution, the intruder never looks like an intruder, because they arrive bearing the credentials and relationships of someone the system already trusts,” he adds.

The pattern is not confined to Africa.

Verizon’s 2026 Data Breach Investigations Report, which examined more than 22,000 confirmed breaches across 145 countries, found that third-party involvement appeared in 48% of cases — up from 30% the previous year.

The sharp rise clearly highlights the growing risk created by organisations’ reliance on vendors, partners and other connected businesses.

• “That’s why, in an interconnected financial system, you’re only as secure as the smallest company you’re connected to,” Ioudom says.

For Nigeria’s increasingly interconnected financial sector, where banks and fintechs rely on networks of partners, vendors and service providers, the implications are significant.

What AI actually changes

None of this dynamic is new. In fact, Fazio Mechanical demonstrated that more than a decade ago, long before generative AI existed.

What AI has changed is how cheaply and quickly attackers can find and exploit the weak link in the first place.

There is now a hard number behind that shift: AI-enabled breaches accounted for one in four malicious breaches globally in the past year, according to IBM’s 2026 Cost of a Data Breach Report, produced with the Ponemon Institute.

And those breaches cost organisations an average of $6 million — roughly $1 million more than the average cost of a breach overall, the report noted.

For Ioudom, the bigger change is how accessible those capabilities have become.

• “Data breaches, fraud and phishing are not new in this world,” he says. “AI has just made it cheaper to access the tools to commit those crimes,” putting capability that once required a skilled team within reach of people who previously lacked it.

Ioudom points out that AI’s ability to create convincing deepfake audio and video is making it harder for humans to detect fraud through routine checks.

The problem, he says, affects companies of all sizes. As AI makes it harder for humans to detect increasingly sophisticated attacks, businesses also need to turn to technology to strengthen their defences.

• “That is why leveraging the same AI to counter these cyber-attacks is no longer optional,” he says.

But technology is only part of the defence. The people using those systems remain a critical vulnerability.

• “In most cyber-attacks, humans are usually the first weak link, not the technology itself,” Ioudom says, highlighting the importance of staff training in preventing attacks.

For larger organisations with established cyber-defence capabilities, he says, it is easier to train employees and invest in the technologies needed to reduce the impact of attacks. But even these organisations are not immune to cyber-attacks.

MSMEs, however, face a different challenge. Ioudom considers them “the most vulnerable,” because many have limited technology and budgets to put the right cybersecurity infrastructure and staff training in place.

Who should carry the weight – MSMEs, larger institutions or governments?

If the vulnerability is structural, Ioudom argues, so must the fix be — and he’s specific about where the responsibility should actually sit.

• “There’s no clean single answer, but if I have to rank it: responsibility should scale with capability,” he says.
• Every business in a connected chain has a baseline duty — the moment a company handles sensitive data or touches critical systems, securing and validating access “is non-negotiable even for the smallest fintech,” he says.

But he’s equally clear that the heaviest burden can’t fall on the party with the least means.

• “An MSME with a five-person team can’t carry the same load as a tier-one bank,” he says.

Instead, he places the greatest responsibility on the larger institutions themselves — “because they’re the ultimate target, they benefit most from the ecosystem, and they’re the only ones with the resources to actually secure it.”

In his view, that means banks and larger fintechs can’t simply audit a small vendor once and move on.

• “They have to set the security standards for everyone they connect to, and help them meet those standards,” he says.
• Once a shared ecosystem exists, security stops being something each company handles alone: joint standards, joint training, shared escalation and response plans, “so that the protection of the strongest extends down to the weakest.”

Government’s role, in his framing, is to set the floor everyone else builds on — clear breach-notification rules and enforceable minimum standards, “so that protecting systems isn’t left to goodwill.”

• Regulation, he says, “is what makes companies take this seriously when commercial incentives alone don’t.”

Closing the gap

Ioudom’s proposed fix follows directly from where he places responsibility: structured partnership, not charity.

• “This is where public-private alliances can help,” he says, “whereby the public sector partners with private micro, small and medium sized enterprises representative groups to bring in professionals to train and educate these businesses.”

For Nigeria, closing the cybersecurity gap will therefore require more than asking small businesses to protect themselves better.

Larger institutions will need to strengthen the businesses connected to them, while government sets enforceable standards and helps expand access to cybersecurity training and expertise.

The challenge is becoming more urgent as AI lowers the barrier to sophisticated attacks. The businesses with the fewest resources to defend themselves may increasingly become the easiest way into the institutions that matter most.