Building Resilient IT Infrastructure Against Cyberattacks in Nigeria: A Cross-Sector Analysis of Banks, Government Agencies and Critical Infrastructure

Between March and April 2026, a single threat actor identified as ByteToBreach compromised four of Nigeria's most critical digital institutions: Sterling Bank, Remita (the Federal Government's Treasury Single Account platform), the Corporate Affairs Commission (CAC), and Ikeja Electric, exploiting a chain of unpatched vulnerabilities, plaintext credential storage, and absent monitoring capabilities. This paper applies comparative case study methodology, guided by the NIST Cybersecurity Framework (CSF) 2018, IT Resilience Theory (Westerman & Hunter, 2007), the Technology Acceptance Model (Davis, 1989), and the Shared Responsibility Model, to conduct cross-sector root cause analysis of the failures that enabled this campaign. Findings reveal that Nigeria's resilience gap is fundamentally organisational rather than technical: institutions that knew about critical vulnerabilities failed to patch them; institutions entrusted with government infrastructure failed to audit third-party credential handling; institutions subject to mandatory breach notification laws failed to notify anyone. The paper argues that technical controls are necessary but insufficient without competent, empowered governance, and that regulatory enforcement, not additional frameworks, is the most urgent unmet need. Sector-specific and cross-sector recommendations are proposed for government regulators, banks, fintech platforms, government agencies, and critical infrastructure operators. Keywords, IT resilience, cybersecurity, Nigeria, NIST CSF, ByteToBreach, zero trust architecture, critical infrastructure, governance, vulnerability management, incident response.