project includes files i used in analysing cyberattacks in Nigeria between 2019 and 2026. It is important to note that the dataset used was generated by Claude AI to reflect real life events in Nigeria
# Nigeria Cybersecurity Incident Analysis (2019–2024)
A SQL-driven analysis of cybersecurity incidents across Nigerian organizations from 2019 to 2024 — covering financial losses, attack trends, response team performance, and resource allocation gaps.
> **Note on the data:** The dataset is synthetic, generated using Claude AI to simulate realistic incident patterns drawn from documented trends in Nigeria's financial, telecom, government, and critical infrastructure sectors. It was built for analytical training purposes, not sourced from real breach records.
---
## Key Findings
- **Banking sector** suffered the highest financial losses of any sector affected by cyber attacks.
- **January** consistently produced the highest number of incidents across all 6 years — a clear seasonal pattern.
- **₦1.4 trillion** in financial losses across all sectors remains unrecovered (unresolved or under investigation).
- **Man-in-the-Middle attacks** are the fastest-growing threat type, with financial losses up **1,541%** between 2019 and 2024.
- **Lagos** has the highest incident-to-response-team ratio in the country, signaling a resourcing gap.
- **Team Apt** was attacked every single year from 2019–2024 — the most persistently targeted team in the dataset.
---
## Dataset Overview
Four related tables, structured as a central fact table with three reference tables:
| Table | Key Columns | Rows |
|---|---|---|
| `incidents` | incident_id (PK), incident_date, org_id, attack_type_id, severity, status, financial_loss_ngn, affected_users, resolution_time_hours, team_id | 5,050 |
| `organizations` | org_id (PK), org_name, sector, city | 100 |
| `attack_types` | attack_type_id (PK), attack_name, description, default_severity | 15 |
| `response_teams` | team_id (PK), team_name, base_city, status | 25 |
**Relationships:**
- `incidents.org_id` → `organizations.org_id`
- `incidents.attack_type_id` → `attack_types.attack_type_id`
- `incidents.team_id` → `response_teams.team_id`
--- …