FG Raises Cybersecurity Alarm as ATM Attack Syndicate Targets African Banks

Nigeria’s Computer Emergency Response Team (ngCERT) has issued a high-risk cybersecurity alert to banks and other financial institutions, warning of a growing wave of sophisticated automated teller machine (ATM) attacks spreading across Africa after cybercriminals reportedly stole more than $2 million from a bank in Senegal.

The advisory, dated June 25, urged financial institutions to strengthen their cyber defences immediately, warning that the emerging threat could inflict severe financial losses, disrupt banking operations, and undermine public confidence if left unchecked.

According to ngCERT, the warning follows a major cyberattack on United Bank for Africa (UBA) in Senegal, where attackers allegedly withdrew over $2 million through 3,421 coordinated ATM transactions after compromising the bank’s card authorisation infrastructure. Investigators said the criminals gained privileged access to critical systems, enabling them to manipulate transaction controls and execute simultaneous cash withdrawals across multiple locations.

The agency explained that cybercriminals typically infiltrate banking networks through phishing campaigns, supply-chain vulnerabilities, or insider access before escalating their privileges and identifying critical systems responsible for ATM transactions, card management, and payment authorisation. Once inside, attackers are able to alter withdrawal limits, adjust fraud detection settings, modify card parameters, and create or manipulate payment card records to facilitate large-scale cash-out operations.

ngCERT warned that successful attacks could result in rapid depletion of ATM cash reserves, compromise of core banking systems, manipulation of customer accounts, data breaches, regulatory sanctions, reputational damage, and widespread disruption of banking services.

To reduce the risk, the agency advised banks to strengthen privileged access controls, enforce multi-factor authentication for administrative accounts, apply the latest firmware updates to ATM infrastructure, restrict unnecessary remote access, and review third-party vendor access.

It also recommended stricter network segmentation, continuous threat monitoring, regular penetration testing, red-team exercises, enhanced staff awareness against phishing and insider threats, and routine testing of incident response plans specifically designed for ATM cash-out attacks.

The advisory underscores growing concerns over increasingly sophisticated cyber threats targeting Africa’s financial sector, with regulators urging banks to adopt stronger cybersecurity measures to safeguard customer funds and maintain confidence in the banking system.