Dearborn Adeyeni

Since last Friday, Lendsqr has been battling a wave of cyberattacks. We are safe, lost no money and no data, and no customer account has been compromised. But we've lost sleep and I have probably drunk a barrel of black coffee. But that is not because they forgot about us. When a few fintechs got hit in early October, we turned on ourselves, found over 800 issues in our own systems and spent three weeks fixing them. That was three weeks before the attacks reached us. This wave has been going through the technology world since early October. Binance lost about $6.3 billion after one engineer's laptop was compromised. Railway told every one of its customers to change all their secret keys. Hundreds of developer accounts on GitHub have been taken over with stolen tokens. Abroad, companies come out and say it, and the next company learns. In Nigeria, we keep quiet. Every company whose people have spoken to me in confidence over the last few days has either been breached or lost money, and not one of them has said a word in public. So, the same people walk into the next company with exactly the same trick. I'm done keeping quiet about it. The way in is almost always a developer: stolen GitHub tokens, infected laptops, and fake recruiters sending a "test project" that compromises your machine the moment you open it. If you are a developer, revoke every GitHub token you have ever created today and scan your machine. If you run a company, turn on two-factor authentication everywhere, remove everyone who has left, change your keys, and pick up the phone when anybody asks you to change where money goes. I've written up everything: how they came at us, what we did, and every attacker address we saw, so you can check your own logs. The link is in the first comment. Thank you to Muyiwa Olufon and the team at @hinokisecurity for standing with us. Abeg, make we speak up. Fraud thrives in darkness.