Small and Medium-sized Enterprises (SMEs) across Nigeria are increasingly becoming targets of cybercriminals, with industry experts warning that many businesses remain ill-prepared to defend themselves against growing digital threats.
The warning is contained in a report by cybersecurity consultant and founder of UltEnterprise, Bolaji Edu, titled “Why Nigerian SMEs Keep Getting Hacked and What the Owners Will Not Admit.” The report argues that many SME owners mistakenly believe cybercriminals only target large corporations, financial institutions and government agencies.
“The question is not whether your business is big enough to be targeted,” Edu said. “The question is whether your data is valuable enough to steal. For most businesses, it is.”
According to the report, Nigeria’s SMEs, which account for a significant share of employment and economic activity, have become attractive targets for hackers due to weak cybersecurity practices and limited investment in digital security.
Rather than targeting businesses individually, cybercriminals increasingly rely on automated tools that scan thousands of computer networks for vulnerabilities such as outdated software, weak passwords and poorly secured systems. Once weaknesses are identified, attackers exploit them to gain access to financial information, customer records and other sensitive business data.
The report found that 78 per cent of surveyed Nigerian SMEs experienced at least one cybersecurity incident within the past year. Of those attacks, 42 per cent were linked to social engineering schemes, including Business Email Compromise (BEC), while 38 per cent resulted from unpatched software vulnerabilities.
Despite the growing threat, only 29 per cent of the surveyed businesses reported having a dedicated cybersecurity budget.
Experts warn that the consequences of cyberattacks often extend beyond financial losses. Malware and ransomware attacks can disrupt business operations, halt productivity, damage customer confidence and expose sensitive information, leaving many small businesses struggling to recover.
The report attributes the low level of cybersecurity preparedness among SMEs to several factors, including the perceived high cost of security solutions, a false sense of immunity among businesses that have never experienced an attack, and limited access to practical cybersecurity guidance.
Edu stressed that improving cybersecurity does not necessarily require expensive technology but rather consistent implementation of basic security measures.
Among the recommendations are enabling multi-factor authentication on business email accounts, maintaining secure offline backups of critical data, regularly reviewing user access permissions and removing inactive accounts, and adopting strong password management practices to prevent credential theft.
As Nigeria’s digital economy continues to expand, cybersecurity professionals say SMEs can no longer afford to treat digital security as an afterthought. They argue that businesses that invest in basic cyber hygiene and staff awareness will be better positioned to withstand evolving cyber threats while maintaining customer trust and operational resilience.