N1.34bn Cyberattack: Access Bank Under Fire as Court Freezes Accounts Across 71 Financial Institutions

How Did N1.34bn Leave Four Customers’ Accounts Before Access Bank Detected the Breach?

Access Bank Plc is facing uncomfortable questions after an alleged cyberattack reportedly resulted in the unauthorised transfer of N1.34 billion belonging to four customers through its Access SME App.

The development is more than a story about stolen money. It raises serious questions about the effectiveness of the bank’s cybersecurity systems, transaction monitoring and ability to protect customers’ funds in an increasingly digital banking environment.

According to court documents, N590.98 million was allegedly moved from MIB TXN Bullion, N420.45 million from AIICO General Insurance Company, N136 million from Apogee Engineering and N193 million from SIMS Nigeria.

The question Nigerians and the affected customers may reasonably ask is simple:

How did such enormous sums leave four corporate accounts without the bank’s security systems immediately stopping or flagging the transactions?

Access Bank reportedly told the Federal High Court in Lagos that it discovered the suspected breach on August 12, 2026, after identifying an incident involving one of its internet banking platforms.

That timeline deserves scrutiny.

When hundreds of millions of naira are transferred from corporate accounts, what alerts were generated? What transaction limits were in place? Were the transfers consistent with the customers’ normal transaction patterns? Were the beneficiaries previously known? And why did the bank allegedly need to approach a court after the money had already been distributed across numerous accounts?

These are not merely technical questions.

They go to the heart of customer confidence and banking responsibility.

Access Bank has now asked the court to impose Post-No-Debit restrictions on beneficiary accounts across 71 financial institutions, disclose their balances and watchlist relevant BVNs.

That means the alleged trail of the money has become sufficiently wide to require the intervention of a major judicial process.

But there is another uncomfortable question:

Where was Access Bank’s internal defence before the court became involved?

The bank says it traced portions of the funds and contacted other financial institutions to preserve whatever remained. Some institutions reportedly placed restrictions on beneficiary accounts.

Yet the fact that the bank had to seek judicial protection to prevent further dissipation inevitably raises questions about the effectiveness of its first line of defence.

The court’s decision is also significant.

Justice Akintayo Aluko granted the preservation-related reliefs but refused Access Bank’s request for immediate reversal of the recovered funds, reasoning that such an order would amount to granting a final remedy at the ex parte stage.

In other words, the court was prepared to protect the disputed money, but not simply hand it back before the other parties had been heard.

The case therefore remains far from over.

Access Bank must now contend with questions about how the alleged breach occurred, when it actually began, when the bank became aware of it, how much money remains traceable and what security controls were supposed to prevent the transactions in the first place.

For the four affected customers, the issue is even more serious.

This is not just about figures on a court document. It is about corporate funds that were allegedly moved without authorisation through a banking platform that customers trusted to protect their money.

And that brings the biggest question of all:

If Access Bank’s systems could allegedly allow N1.34 billion to move from four customers before the breach was detected, who should ultimately bear the cost of that failure?

Should customers carry the consequences of a security breach they did not authorise?

Should other banks become responsible for chasing money allegedly routed through their accounts?

Or should the financial institution whose digital platform was allegedly exploited provide a clearer explanation of what happened and how such an incident will be prevented from happening again?

The answers matter—not only to Access Bank’s customers, but to millions of Nigerians increasingly dependent on digital banking.

The court has adjourned the matter until August 31, 2026.

Until then, the biggest issue confronting Access Bank is not simply where the N1.34 billion went.

It is how N1.34 billion allegedly got out in the first place.