Lendsqr Fights Cyberattack Wave, Says Fintechs Stay Silent

Lendsqr, the Lagos company whose software lenders use to run loan businesses, has been fighting a wave of cyberattacks since Friday 30 October, its founder and chief executive Adedeji Olowe wrote on his blog on 4 November. He says the company has lost no money and no data, and that no customer account has been compromised.

The bigger claim is about everyone else. Olowe says every company whose people have spoken to him in confidence over the last few days has either been breached or lost money, and that not one has said so in public. He did not name them. The Condia, which reported the post, describes Nigerian financial institutions as under growing pressure from attacks while the industry stays largely silent.

How the attacks came

According to Olowe, the first wave hit on 30 October while Lendsqr's team was on a call about taking a customer live, so they watched it happen. A second wave came on the night of Sunday 2 November and was caught because one of the company's security staff happened to be awake.

He says the way in is almost always a developer. Attackers steal the access tokens developers use for GitHub, from infected laptops or old leaks, and use them to plant code that copies out the secrets a company keeps in its software pipelines. Some pose as recruiters and send job candidates a test project; with some of these, he writes, simply opening the folder in a code editor is enough to compromise the machine. Binance said its $6.3 billion loss on 29 October started with a fake job interview.

At Lendsqr's own doors, Olowe says, the attackers rented cheap servers, mostly in Asia, and dropped each one as soon as it was blocked. They scanned public pages and login screens, tried to guess staff passwords, including those of staff at lenders using the platform, sent fake payment notifications, and in one case came in with a borrower's correct password, stolen elsewhere, before device checks stopped them. He has published the IP addresses used in both waves so other firms can check their logs.

Related · AI and Tech StakBinance: $6.3B Hack Began With a Fake Job InterviewBinance's incident report says hackers posing as recruiters planted malware via a coding test, then used an internal AI tool to reach its wallets.

Why Lendsqr says it held

Olowe says that when a few fintechs were hit around 1 to 3 October, Lendsqr ran a full internal review of its own code and systems, found more than 800 issues from small to serious, and spent three weeks fixing them. Since the attacks began it has written to every developer who worked with it in the last six years, asking them to revoke their tokens and clean their machines, warned its customers, and blocked most of Asia from its services. He says AI tools have cut the time to pull its logs together from three or four hours to about ten minutes, and warns that the tighter blocking may cause some glitches for customers, especially travellers, over the next week.

His advice to developers is to revoke and reissue every GitHub token, scan their machines and never run code from strangers, however good the job sounds. To companies: turn on two-factor authentication for email, cloud, code and anything that touches money, remove former staff, rotate keys and passwords, and call to confirm any request to change where money goes.

The post lands a day before the deadline the Securities and Exchange Commission set for capital market operators to file cybersecurity risk assessments, part of a sector-wide review by Nigeria's financial regulators. The Condia notes a 2025 precedent: a Federal High Court in Lagos ordered 54 banks to return about ₦9.3 billion moved out of a breached institution.