Cybersecurity experts urge Nigerians to strengthen password practices amid Global surge in data breaches

As cyberattacks and data breaches continue to rise globally, cybersecurity experts have warned Nigerians to strengthen their password protection habits to safeguard personal and business data from potential compromise.

In recent months, multiple large-scale breaches have exposed millions of email addresses, passwords, and sensitive user information, underscoring the vulnerability of individuals and organisations when basic security practices are neglected.

Experts say that with the growing adoption of digital banking, e-commerce, and online learning platforms in Nigeria, ensuring robust password security is more critical.

Frank Samuel, Investment Associate at Sahara Impact Ventures, emphasised the importance of proactive security management. “Managing passwords in this day and age is critical for personal data security. It is important to activate all means of maximum security on platforms that hold your details, including two-factor authentication (2FA) and the use of security keys.

“Also, everyone should stay updated on the privacy policies of apps and web portals we constantly engage with, as not every privacy policy update may be favourable for users,” Samuel added.

Read also: Cybersecurity is crucial for SMEs growth, says Osholeye

According to Check Point Research, global cyberattacks increased by over 20 percent in the first half of 2025, with Africa emerging as one of the regions most targeted by phishing and credential theft campaigns. In Nigeria, both financial and educational institutions have recorded a surge in attempted account compromises.

The urgency for improved security practices grew after the largest password leak on record occurred in June 2025, exposing more than 16 billion login credentials collected by info-stealer malware from user devices.

The dataset found on the dark web contained user data from major platforms, including Google, Facebook, and Apple, heightening the risk of identity theft, fraud, and account takeovers.

Kaspersky, in a public advisory, urged users to act swiftly. “Yes, we don’t reliably know whose data is in this leak, but that doesn’t mean you should do nothing. The first and best recommendation is to change your passwords.

“For example, take a favourite line from a song or movie and replace every second or third letter with special characters that aren’t sequential on the keyboard.
If you’re a fan of Harry Potter, you might transform ‘Wingardium Leviosa’ into something like ‘Wi4ga/di0mL&vi@sa’.”

Jed Oyeneye, lead faculty at The Hacktive Campaign, described passwords as ‘the first and most personal line of defence’ in today’s digital economy.

“Yet, many still treat them as casual access tokens rather than the cryptographic keys they truly are. The truth is simple: your password is your armour. They have to be unique, long, protected, and constantly monitored,” Oyeneye said.

He advised individuals and organisations to adopt zero-knowledge password managers, which securely store and generate new, random, and high-entropy passwords for every account.

Read also: AI deepfakes are redefining cybersecurity: Expert warns ‘Verify First, Then Trust’

“By removing human memory from the equation, you eliminate the temptation to reuse passwords across platforms,” he noted.

According to Oyeneye, password length is more important than complexity. “A 16-character passphrase made of random words, like ‘river+nile-table-lagos=horizon’, is exponentially stronger than a short, complex one like ‘Complex#1!’. Length increases entropy, and entropy makes guessing practically impossible.”

He further urged business leaders to work closely with their Chief Information Security Officers (CISOs) to implement phishing-resistant multi-factor authentication (MFA) systems.

“FIDO2 or WebAuthn hardware keys like YubiKey or Google Titan offer near-impenetrable protection against phishing and man-in-the-middle attacks, far beyond what SMS-based one-time passwords can provide,” Oyeneye advised.

Oyeneye also highlighted the importance of continuous monitoring and recovery planning, noting that tools like Have I Been Pwned can help users detect compromised credentials.

“Once a breach is detected, immediate password rotation and review of related accounts can prevent cascading compromises,” he said. “No armour is complete without recovery planning—store recovery codes offline, set login alerts, and maintain a playbook for responding to compromised credentials.”

In recognition of Cybersecurity Awareness Month 2025, Oyeneye encouraged individuals and businesses to take digital safety more seriously.

Here are simple steps to stay safe online security professionals recommend the following measures to enhance password protection and minimise the risk of breaches:

Use Strong, Unique Passwords by avoiding predictable combinations like ‘123456’ or ‘password.’ Mix upper and lowercase letters, numbers, and symbols for each account.

Read also: From identity to cybersecurity: Stakeholders map road to seamless e-government in Nigeria

Enabling Two-Factor Authentication (2FA) by adding a second layer of verification, such as a one-time code, greatly improves security.

Use a password manager with tools like 1Password, Bitwarden, and Google Password Manager to help securely generate and store passwords.

Avoid public Wi-Fi for sensitive transactions, as hackers can intercept data on unsecured networks. Regularly update passwords by changing passwords every few months or after any suspected breach.

Stay alert to Phishing Scams and avoid clicking on suspicious links or attachments in unsolicited emails.