Sycamore Confirms X Account Compromise, Warns Users

In Short

Sycamore says its official X account was taken over by an unauthorized party. The fintech is trying to regain control and asked users to ignore posts, links, and DMs from the account.

What Happened

Nigerian fintech Sycamore said on April 30 that its X account, @SycamoreNG, had been compromised.

The company shared the update on other channels and told users to disregard any suspicious activity. That includes recent posts, links, or messages coming from the X profile.

Sycamore did not explain how the account was accessed. It also did not say what content the attacker posted or whether any customers were affected.

A screenshot shared by Condia shows a post promoting a token, $Goblin, and a link. This is a common pattern in social media takeovers, where attackers use trusted brand accounts to push crypto scams and phishing links (links designed to trick people into giving up passwords or money).

Why It Matters

For fintechs, social media accounts are part of customer support and brand trust. A compromised account can be used to send fake support messages, share malicious links, or impersonate staff.

The incident also highlights a wider issue in African tech. High-visibility accounts remain targets, especially when they can be used to drive traffic to scam pages.

Sycamore’s case echoes past breaches in Nigeria. In 2022, Opay said its verified Twitter account was compromised and used to direct users to a cloned website.

Customers should treat any link shared from the affected account as untrusted until the company confirms recovery. They should also avoid sharing one-time passwords, recovery codes, or login details in DMs.