WhiteHat NG is Nigeria's leading CERT-style Information Sharing and Analysis Center (ISAC). Founded in 2019, it serves as a people's Computer Emergency Response Team, providing cybersecurity advisories, vulnerability disclosure services, and threat intelligence to protect Nigerian cyberspace. WhiteHat NG publishes security advisories about vulnerabilities and threats affecting Nigerian organizations and citizens.

How do I report a security vulnerability to WhiteHat NG?

You can report security vulnerabilities through WhiteHat NG's Vulnerability Disclosure Program (VDP) at whitehat.ng/vdp/report. The platform accepts reports about vulnerabilities in Nigerian digital infrastructure, government systems, and private sector applications. All reports are handled confidentially by trained security professionals who coordinate responsible disclosure with affected organizations.

What types of security advisories does WhiteHat NG publish?

WhiteHat NG publishes four severity levels of security advisories: Critical (immediate action required), High (significant risk), Medium (moderate risk), and Low (minimal risk). Advisories cover topics including software vulnerabilities, malware campaigns, phishing attacks, data breaches, and emerging cyber threats affecting Nigeria. All advisories are available via web and RSS feed at whitehat.ng/advisories.

Is WhiteHat NG affiliated with the Nigerian government?

WhiteHat NG operates as an independent, community-driven cybersecurity organization. While it collaborates with government agencies and private sector partners on security matters, it maintains independence to serve as a trusted neutral party for vulnerability disclosure and security coordination. This independence allows WhiteHat NG to advocate for both security researchers and affected organizations.

How can organizations partner with WhiteHat NG?

Organizations can partner with WhiteHat NG through several programs: becoming an information sharing partner for threat intelligence, participating in the Vulnerability Disclosure Program as a receiving organization, sponsoring cybersecurity awareness initiatives, or contributing to advisory development. Contact partnerships@whitehat.ng or visit the About page for more information on collaboration opportunities.

Comparative Analysis: Ransomware Incidents in Nigeria (2025 vs. 2026)

Based on data monitored from public dark-web leak sites for Nigeria, ransomware threat activity against Nigerian organizations has evolved significantly between 2025 and 2026.

Metric / Focus	2025 Data	2026 Shift
Recorded Incidents	8 recorded victims	9 recorded victims (as of August 2026)
Dominant Threat Groups	Killsec, Funksec, Qilin, Kazu, Nightspire	Panzer, Krybit, Exfilsquad, Arcusmedia, Deadlock, Killsec
Sector Targeting	Public/State portals, legal, insurance, fast food, research, and credit systems	Major commercial banking, microfinance, pension administration, news/media, wellness, and oil & gas
Impact Depth	Peripheral service disruptions, smaller file dumps (~5MB)	Massive exfiltration of high-revenue targets (e.g., single leaks reaching ~90M PII and banking relationship records)
Repeat Targeting	Early-stage targeting of single financial/pension management targets	Re-targeting of financial and pension entities by new, specialized groups

Strategic Advisory for Nigerian Enterprises

To counter the expanding targeting of high-value database assets and financial infrastructure observed in the 2026 data, organizations should implement the following security controls:

Data Protection & Access Control

Phishing-Resistant Authentication: Transition from SMS-based MFA to hardware keys or FIDO2/WebAuthn standards for all corporate credentials and portal access.
Database Isolation: Enforce microsegmentation around core banking, customer relationship, and pension management databases to stop lateral movement from peripheral systems.

Exfiltration Defense

Egress & DLP Controls: Implement automated Data Loss Prevention (DLP) to monitor and block unauthorized bulk transfers of Personally Identifiable Information (PII) or customer account data.
Immutable Backups: Maintain isolated, Write-Once-Read-Many (WORM) offsite backups to ensure operational recovery without needing to negotiate ransom demands.

Threat Intelligence & Vendor Management

Continuous Monitoring: Audit external-facing endpoints and cloud environments regularly to detect early access attempts before data staging occurs.
Supply Chain Verification: Enforce strict cyber health checks and rapid breach notification SLAs for third-party software, credit, and tech partners.

Whitehat.NG