The rapid expansion of digital banking in sub-Saharan Africa has enlarged the attack surface available to cybercriminals targeting financial institutions. This study examines the nature, frequency and financial consequences of cybersecurity incidents at seven large Nigerian commercial banks over 2015-2023. It combines a documented-incident analysis, a pre/post comparison of bank performance and a fixed-effects panel regression. The regression indicates that a confirmed major cybersecurity incident is associated with a reduction in return on assets (ROA) of 0.547 percentage points (p < 0.001), and that larger confirmed losses are associated with lower ROA. For the six banks with an observable post-incident year, mean ROA fell from 2.00% to 1.47%, mean return on equity (ROE) from 14.75% to 10.65%, and the non-performing loan (NPL) ratio rose by 1.6 percentage points on average. The seven documented incidents generated aggregate direct losses of USD 32.5 million; ransomware, phishing/business email compromise (BEC) and mobile-channel (SIM-swap) fraud were the three costliest attack types, together accounting for 64% of that total. The estimates are interpreted as associations rather than causal effects. The paper discusses implications for the Central Bank of Nigeria (CBN) risk-based cybersecurity framework, international standards (ISO/IEC 27001, NIST CSF 2.0) and the operational-risk provisions of Basel III, and contributes to the literature on the microeconomic consequences of cybercrime in developing economies.
References
[1]
Nigeria Inter-Bank Settlement System (NIBSS) (2024) Nigeria Recorded N600 Trillion e-Payment Transactions in 2023. NIBSS. <br>https://nibss-plc.com.ng/nigeria-recorded-n600-trillion-e-payment-transactions-in-2023/
Financial Institutions Training Centre (FITC) (2023) Reports of Fraud and Forgeries in Nigerian Banks (Quarter 2, 2023). FITC.
[4]
Cybersecurity Ventures (2023) Cybercrime to Cost the World $10.5 Trillion Annually by 2025. <br>https://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/
Central Bank of Nigeria (CBN) (2023) Annual Report on Banking Supervision 2022. CBN Publications.
[7]
Okunoye, A. and Karsten, H. (2022) Cybersecurity Resilience in African Financial Institutions: An Organisational Capability Perspective. <i>Information Systems Journal</i>, 32, 298-327.
[8]
Central Bank of Nigeria (CBN) (2018) Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Providers. CBN. <br>https://www.cbn.gov.ng/out/2018/bsd/risk%20based%20cybersecurity%20framework%20final.pdf
[9]
Akerlof, G.A. (1970) The Market for “Lemons”: Quality Uncertainty and the Market Mechanism. <i>The Quarterly Journal of Economics</i>, 84, 488-500. <br>https://doi.org/10.2307/1879431
[10]
Anderson, R. and Moore, T. (2006) The Economics of Information Security. <i>Science</i>, 314, 610-613. <br>https://doi.org/10.1126/science.1130992
[11]
Stiglitz, J.E. and Weiss, A. (1981) Credit Rationing in Markets with Imperfect Information. <i>American Economic Review</i>, 71, 393-410.
[12]
Basel Committee on Banking Supervision (BCBS) (2021) Revisions to the Principles for the Sound Management of Operational Risk. Bank for International Settlements.
[13]
Basel Committee on Banking Supervision (BCBS) (2017) Basel III: Finalising Post-Crisis Reforms. Bank for International Settlements. <br>https://www.bis.org/bcbs/publ/d424.htm
[14]
Barney, J. (1991) Firm Resources and Sustained Competitive Advantage. <i>Journal of Management</i>, 17, 99-120. <br>https://doi.org/10.1177/014920639101700108
[15]
Wernerfelt, B. (1984) A Resource-Based View of the Firm. <i>Strategic Management Journal</i>, 5, 171-180. <br>https://doi.org/10.1002/smj.4250050207
[16]
Bharadwaj, A.S. (2000) A Resource-Based Perspective on Information Technology Capability and Firm Performance: An Empirical Investigation. <i>MIS Quarterly</i>, 24, 169-196. <br>https://doi.org/10.2307/3250983
[17]
Spence, M. (1973) Job Market Signaling. <i>The Quarterly Journal of Economics</i>, 87, 355-374. <br>https://doi.org/10.2307/1882010
[18]
Cavusoglu, H., Mishra, B. and Raghunathan, S. (2004) The Effect of Internet Security Breach Announcements on Market Value: Capital Market Reactions for Breached Firms and Internet Security Developers. <i>International Journal of Electronic Commerce</i>, 9, 70-104. <br>https://doi.org/10.1080/10864415.2004.11044320
[19]
Goel, S. and Shawky, H.A. (2009) Estimating the Market Impact of Security Breach Announcements on Firm Values. <i>Information & Management</i>, 46, 404-410. <br>https://doi.org/10.1016/j.im.2009.06.005
[20]
Nwankwo, O. and Eze, G. (2021) Electronic Banking Fraud and Financial Performance of Deposit Money Banks in Nigeria. <i>International Journal of Economics and Financial Issues</i>, 11, 34-44.
[21]
Yusuf, M.B., Sani, M.A. and Balogun, K. (2022) Cybersecurity Threats and Financial Performance: Evidence from Nigerian Deposit Money Banks. <i>Lapai International Journal of Management and Social Sciences</i>, 13, 212-228.
[22]
Kamiya, S., Kang, J., Kim, J., Milidonis, A. and Stulz, R.M. (2021) Risk Management, Firm Reputation, and the Impact of Successful Cyberattacks on Target Firms. <i>Journal of Financial Economics</i>, 139, 719-749. <br>https://doi.org/10.1016/j.jfineco.2019.05.019
[23]
International Monetary Fund (IMF) (2024) Chapter 3. Cyber Risk: A Growing Concern for Macrofinancial Stability. In: <i>Global Financial Stability Report</i>,<i> April</i> 2024, IMF. <br>https://www.imf.org/-/media/Files/Publications/GFSR/2024/April/English/ch3.ashx
[24]
World Economic Forum (WEF) (2023) The Global Risks Report 2023. 18th Edition, WEF. <br>https://www.weforum.org/reports/global-risks-report-2023/
[25]
MITRE Corporation (2023) MITRE ATT&CK®. Version 14. <br>https://attack.mitre.org/
[26]
Nigeria Inter-Bank Settlement System (NIBSS) (2023) Industry Electronic Fraud Report Q3 2023. NIBSS.
[27]
Hausman, J.A. (1978) Specification Tests in Econometrics. <i>Econometrica</i>, 46, 1251-1271. <br>https://doi.org/10.2307/1913827
[28]
Driscoll, J.C. and Kraay, A.C. (1998) Consistent Covariance Matrix Estimation with Spatially Dependent Panel Data. <i>Review of Economics and Statistics</i>, 80, 549-560. <br>https://doi.org/10.1162/003465398557825
[29]
Campbell, K., Gordon, L.A., Loeb, M.P. and Zhou, L. (2003) The Economic Cost of Publicly Announced Information Security Breaches: Empirical Evidence from the Stock Market. <i>Journal of Computer Security</i>, 11, 431-448. <br>https://doi.org/10.3233/jcs-2003-11308
Central Bank of Nigeria (CBN) (2024) Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks and Payment Service Banks. CBN.
[32]
ISO/IEC 27001:2022 (2022) Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements. International Organization for Standardization.
[33]
National Institute of Standards and Technology (NIST) (2024) The NIST Cybersecurity Framework 2.0. NIST.
[34]
African Union Commission (2024) Status of Ratification: African Union Convention on Cyber Security and Personal Data Protection. AU Commission. <br>https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection
