The Danger of Silence: Why Organizations Must Speak Up About Their Cyberattacks

Cyberattacks are everyone's problem

On the evening of 29 October 2026, about USD 6.36 billion left Binance's wallets across ten blockchains. Most of it moved in roughly 20 minutes. It is the largest crypto theft on record, about four times the Bybit hack of February 2025 (TRM Labs).

Blockchain analysts traced the attack to TraderTraitor, a North Korean hacking unit. The FBI later confirmed North Korea was responsible (NPR). Binance said its first findings pointed to a compromised engineer's laptop. A deeper investigation then found additional points of breach (PBS NewsHour).

What happened next matters as much as the theft. Binance spoke publicly within hours. It suspended withdrawals, worked with blockchain partners to freeze roughly USD 3 billion, and set aside more than USD 6.34 billion of company funds to cover users (PBS NewsHour). Those freezes were only possible because other organizations knew, quickly, what to look for.

Four days later, the threat left the screen and entered the shop floor. On 2 November, attackers pushed supermarket freezer temperatures to 50°C in at least 11 European countries. Tonnes of food were thrown away. The European Union said the attacks were not isolated and promised a collective response (Al Jazeera). Refrigeration maker Danfoss said its products were involved, as they had been when about 700 French stores were hit in October (Claims Journal).

The French attack was a warning. Every retailer running similar systems had a few weeks to act on it. The second wave shows what happens when a warning travels slower than the attackers.

For some organizations, there is no second chance. In mid-October, attackers used internal credentials stored in plain text to break into the cloud platform Zeabur and reach its production database. Data tied to 321,810 accounts was exposed, and the company announced it would shut down (CM Alliance; GRC Solutions).

A crypto exchange. A continent's food supply chain. A technology company that no longer exists. None of these were IT problems. They were problems of business continuity, economic stability, public safety and trust.

One researcher counted 49 publicly disclosed breaches and attacks in October 2026 alone, with at least 67.6 million records confirmed as breached (GRC Solutions). The key words are publicly disclosed. Those are the incidents we know about. The question this article asks is about the rest.

The culture of silence

Many organizations fear the headline more than the hacker. That is an uncomfortable truth, but it explains a great deal.

The reasons for silence are familiar. Leaders worry about reputational damage. They fear customers will leave and investors will lose confidence. They fear regulators, lawsuits and fines. Some find it hard to admit that their systems had a weakness. Others face internal pressure to manage perception until the story goes away.

Underneath all of this sits one quiet assumption. If we do not talk about it, it did not really happen.

That assumption is wrong, for three reasons.

The attacker already knows. Silence keeps an incident secret from customers, partners and regulators. It does not keep it secret from the people who caused it. Stolen data is sold, published or used for fraud whether the victim speaks or not.

The story comes out anyway. Today, criminal groups announce their victims on leak sites. Researchers track those sites daily. Journalists verify the claims. When an organization stays quiet, the public often learns of the breach from the criminals first. The organization then has to explain both the breach and the silence.

Silence leaves others exposed. Attackers reuse what works. The same vulnerability, the same vendor and the same technique are tried again on the next target. The supermarket attacks show this clearly. An incident that one organization keeps to itself is a lesson every other organization is denied.

This is the core of the argument. Protecting an organization's reputation and protecting the people who depend on it are not the same goal. When they conflict, silence chooses the reputation. Customers whose data was taken lose the chance to change passwords, watch their accounts and question suspicious calls. Partners connected to the same systems lose the chance to check their own exposure.

Responsible disclosure is not a confession. It is an act of protection. It tells people what happened, what it means for them and what they should do next.

There is no shame in being breached

Much of the silence comes from one feeling: shame. It needs to be named and set aside.

Being breached is not a moral failure. As technology evolves, attacks will only become more frequent and more sophisticated. Banks, governments and the world's largest technology companies have all been hit. No organization can promise it never will be.

The shame does not belong to the people who were attacked. It belongs to the attackers. And the surest way to put it back where it belongs is for people, organizations, governments and nations to stand together against them. That can only happen when victims speak.

What organizations should be judged on is not whether they were breached. It is how they responded.

AI is changing the economics of attack

Artificial intelligence has made attacks cheaper, faster and more convincing. It has also lowered the skill needed to launch them.

In September 2026, researchers at SOCRadar found an exposed server belonging to an operator in the n0n ransomware group. Inside was an AI coding agent wired to 154 models, including models with their safety controls removed. It had written and debugged hundreds of attack scripts, at an AI bill of more than USD 7,200. By 19 October, the group listed 93 victims and ransom demands totalling USD 283.7 million (SOCRadar).

The detail that matters most is how n0n got in. Not through some new AI-powered exploit. It got in by trying weak and stolen passwords on internet-facing VPNs (Crypto Briefing). AI did not create a new weakness. It let a small crew exploit an old one at industrial scale.

The same pattern runs through the year's biggest incidents. Chainalysis said the Binance attackers appeared to use automation to push thousands of transactions in a short window to hide the trail of funds (CNN).

AI is also changing how people are deceived. It now produces:

• Phishing emails with no spelling errors, written in the target's industry language.
• Cloned voices of executives requesting urgent payments.
• Deepfake video on calls, and fake job candidates in remote interviews.
• Synthetic identities built to pass onboarding checks.

Entrust's 2026 Identity Fraud Report, based on more than one billion identity checks, found deepfakes in one of every five biometric fraud attempts (Deepstrike summary).

This breaks some old assumptions. A familiar voice is no longer proof of identity. A well-written email is no longer a sign of legitimacy. An annual awareness session is no longer enough preparation.

It also changes the case for speaking up. When attackers can rewrite their tools in hours, the window between one victim and the next shrinks. A lesson shared in a week may be too late. A lesson never shared is a gift to the attacker. In an AI-driven threat landscape, collective intelligence is not a nice idea. It is a defensive necessity.

Bringing it home: what this means for Nigeria

Nigeria is not watching this from a distance. Kaspersky recorded 1.6 million online attack attempts against Nigerian users in the first half of 2026, placing the country among the five most targeted in its Middle East, Türkiye and Africa region (BusinessDay). The NDPC estimates the country now records a cyberattack roughly every 39 seconds. Prembly reported that AI-driven attacks on the financial sector rose 150 percent in a year (Techeconomy).

A year of hard lessons

2026 tested how Nigerian institutions respond when the attack is real.

In late March, a threat actor calling itself ByteToBreach claimed it had breached Sterling Bank, alleging access to about 900,000 customer accounts and more than 3,000 employee records. It then claimed a breach of Remita, the platform that processes government salaries, taxes and payments (Nairametrics). The NDPC served both organizations notices of investigation on 1 April (ITWeb). Press reports in early April noted that Sterling Bank had not issued a public statement confirming or denying the claims (WeeTracker).

On 15 April, the Corporate Affairs Commission confirmed unauthorized access to limited parts of its systems. It activated its response protocols and urged portal users to update their login credentials. It did not disclose the scale of the breach or whether data was taken (Technext). The NDPC opened an investigation two days later.

In August, Zenith Bank emailed customers to say attackers had accessed limited information, including email addresses and phone numbers. It said no financial data was compromised and warned customers to watch for phishing that might follow (Nairametrics).

These responses differ, and the difference is the point. A customer told that their phone number has leaked can treat the next "bank" call with suspicion. A customer told nothing cannot.

What is really at stake

Nigeria's digital economy runs on trust. Fintech apps, mobile money, digital banking, telecoms, e-commerce, digital identity and government portals all ask citizens to hand over data and money on faith.

When a bank is breached, KYC documents become raw material for fraud. When a registry like the CAC is breached, the integrity of corporate identity is in question. When a payments platform is breached, the exposure reaches every agency connected to it. When a government service goes offline, citizens lose access to something they cannot get elsewhere.

Each incident handled in silence draws down a shared account of public confidence. That account funds financial inclusion, foreign investment and the whole digital transformation agenda.

The rules already require speaking up

Nigeria's law has moved toward disclosure. The duties below already apply:

Sources: Aluko & Oyebode; Digital Policy Alert; G Elias via Mondaq; ESET Nigeria. A national framework with mandatory incident reporting is also being developed (Dark Reading).

Compliance is the floor, not the goal. Many Nigerian businesses are digitizing faster than they are building incident response. The real question is not whether a report reaches a regulator within 72 hours. It is whether the people at risk learn what they need to protect themselves.

A message to leadership

This section is for the boardroom.

Cybersecurity is not the IT department's problem. It is not the CISO's problem alone, and it cannot be outsourced to a vendor. It is a leadership responsibility. Regulators already say so. The CBN framework places cybersecurity oversight with the board (G Elias via Mondaq). The NCC now requires board-level security training for telecom operators at least twice a year (ESET Nigeria).

The decision to speak or stay silent is never made by a technician. It is made in the C-suite, often within hours, under pressure. The culture that shapes that decision is built long before the incident.

Here is what that culture looks like:

1. Make it safe to raise the alarm. An employee who clicks a bad link and reports it within minutes has done the organization a service. Punish the click and you teach people to hide the next one.
2. Decide your disclosure approach before you need it. Agree in advance who speaks, to whom, through which channels and on what triggers. A crisis is the worst time to design a process.
3. Respond and notify on time. Regulatory clocks start at detection, not at the end of the investigation. Stakeholders at risk deserve to hear early enough to act. That means regulators and your sector CERT, not only customers.
4. Share lessons without exposing what must stay protected. Indicators of compromise, the vendor involved and the technique used can help peers. Exploitable details and evidence in a live investigation can stay confidential.
5. Invest before the incident. Patch management, credential hygiene and monitoring cost far less than recovery. Several of 2026's headline incidents trace back to basics: weak or stolen passwords on a VPN, a credential stored in plain text.
6. Rehearse. Test your incident response and crisis communication plans with the executives who will actually be in the room.
7. Treat transparency as an asset. Customers forgive breaches more readily than they forgive being misled.

A clear distinction matters here. Speaking up does not mean publishing every technical detail. It does not mean compromising an investigation or handing attackers a map. It means telling stakeholders what they need to know, through the right channels, at the right time.

Cybersecurity is not an operating expense to be minimized. It is part of how an organization governs itself, stays resilient and earns the right to be trusted.

From self-protection to collective responsibility

No single company, regulator or security team can solve this alone. The Binance response worked as well as it did because blockchain partners moved together to freeze funds. Europe's supermarket attacks became a regional matter the moment the EU called them connected. Defence scales when knowledge moves.

Everyone in the ecosystem holds a piece of it:

• Individuals practise basic cyber hygiene, question unusual requests and report what looks wrong.
• Employees follow security procedures and raise concerns early, without waiting to be sure.
• Organizations invest in security, build working incident response and share relevant lessons with peers.
• Boards and executives provide oversight, fund the work, reward transparency and hold people accountable.
• Regulators give clear guidance, make reporting workable and enforce consistently, so that honest disclosure is not punished more harshly than concealment.
• Government protects critical infrastructure, builds national capacity and supports public awareness.
• Technology providers and security professionals help organizations find threats, strengthen defences and respond well.

Sharing does not have to mean going public on day one. It can mean reporting to a sector CERT, briefing a trusted industry group or alerting a vendor that its product was the way in. What matters is that the lesson travels.

Report to the channels that can act

Telling customers is only half of speaking up. The other half is telling the people who can warn everyone else.

A customer notice protects the people already affected. A report to the right authority can protect the next organization before it is hit. Regulators and response teams see across a whole sector. They can spot a pattern, issue an advisory and push a fix to every institution running the same system. They cannot act on what they are never told.

In Nigeria, those channels already exist:

• ngCERT, through your sectoral CERT or security operations centre, for cyber incidents under the Cybercrimes Act.
• The NDPC, when personal data is involved.
• Your sector regulator, such as the CBN for banks and payment service banks, or the NCC for telecom operators.
• The Nigeria Police Force National Cybercrime Centre, where a crime has been committed.
• Industry peers and affected vendors, through trusted sharing groups or direct contact, so the same door is closed elsewhere.

Regulators have noticed the gap. A senior official at NIBSS said some institutions had reported zero incidents, and called non-reporting unacceptable (Dark Reading). A sector that does not report cannot see its own threats.

Reporting is not an admission of failure. It is how one incident becomes an industry's early warning.

The logic is simple. One organization's incident, responsibly shared, can be another organization's prevention. A breach at one bank that is reported through the right channels can help ten other banks close the same door before anyone walks through it.

Be your brother's keeper

Many of us grew up hearing an old question. Am I my brother's keeper? The question was first asked to avoid responsibility. The answer we were raised on is yes.

In cybersecurity, that answer has a practical meaning. It means speaking up when something goes wrong. It means sharing what you learned so others do not have to learn it the hard way. It means reporting the strange email, the odd login and the call that does not feel right.

When one organization shares its experience responsibly, another may close a gap before it is exploited. When one employee reports a suspicious message, a colleague may never receive the second one. When one customer is warned in time, a fraud may never happen.

Cybersecurity is not a competition. No organization wins when its competitor is breached, because the next attack uses the same door. No organization operates in isolation, and none is immune.

We share the same networks, the same vendors, the same payment rails and the same customers. We also share the same risk. The only question is whether we share the knowledge that could reduce it.

Cybersecurity is a group effort. It takes individuals, organizations, leaders, regulators and government working together to keep our digital spaces safe. So speak up. Share what you know. Report what you see. Learn from every incident, including the ones that happen to someone else.

Being attacked is not a disgrace. The shame belongs to the attackers, and it grows every time the rest of us stand together against them.

Silence protects no one. Be your brother's keeper.

References

Global incidents

1. TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 29 Oct 2026.
2. NPR, A simple explainer of the massive $6.3 billion crypto heist at Binance, 31 Oct 2026.
3. PBS NewsHour, What to know about the $6.3B hack on Binance, 31 Oct 2026.
4. Bloomberg, Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack, 29 Oct 2026.
5. CNN, Hackers just stole $6 billion in crypto, 30 Oct 2026.
6. Al Jazeera, EU urges action as Germany, Romania and UK report supermarket cyberattacks, 4 Nov 2026.
7. Claims Journal (Bloomberg), Supermarkets Across Europe Report New Suspected Freezer Hack, 2 Nov 2026.
8. CM Alliance, Biggest Cyber Attacks, Data Breaches, Ransomware Attacks: October 2026.
9. GRC Solutions, Global Data Breaches and Cyber Attacks in October 2026.

AI and the threat landscape

10. SOCRadar, n0n Ransomware: Inside an AI-Assisted Extortion Operation, Oct 2026.
11. Crypto Briefing, N0n ransomware group spends $7K on AI tools, then leaves its own server wide open.
12. Deepstrike, Deepfake Statistics 2026 (summarizing the Entrust 2026 Identity Fraud Report).

Nigeria

13. BusinessDay, Nigeria battles 1.6m online cyberattacks in H1 2026 as AI threats escalate, 30 Jul 2026.
14. Techeconomy, Zenith Bank Confirms Data Breach as Cyberattacks on Nigerian Banks Intensify, 5 Aug 2026.
15. Nairametrics, NDPC probes Remita, Sterling Bank over alleged data breach, 6 Apr 2026.
16. ITWeb Africa, Nigerian regulator opens a probe into possible data leak, Apr 2026.
17. WeeTracker, A Nigerian Bank's CEO Had His Home and Transactions Exposed, 9 Apr 2026.
18. Technext, CAC suffers cyberattack, begins investigation with NITDA support, Apr 2026.
19. Nairametrics, Zenith Bank alerts customers after cyber incident exposed contact details, 4 Aug 2026.

Regulation

20. Aluko & Oyebode, Cybersecurity incident reporting obligations under Nigerian law.
21. Digital Policy Alert, Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.
22. G Elias via Mondaq, Overview of the CBN Risk-Based Cybersecurity Framework and Guidelines, Sept 2024.
23. ESET Nigeria, Four Hours: Nigeria's New Deadline for Reporting a Cyberattack, Aug 2026.
24. Dark Reading, Nigeria Deepens Cybersecurity Efforts as Cybercriminals See More Profits, 15 Jul 2026.
25. Global Law Experts, How to Report a Data Breach in Nigeria Online, 2026.