Nigerian Data Breach Case Studies: What They Teach About NDPA Compliance
Last updated: July 2026.
Nigerian data breach case studies point to the same conclusion: for most organisations, the question is no longer whether a breach will happen, but how prepared they’ll be when it does.
The headlines have shifted accordingly, from “what happened” to “who’s next.” From Flutterwave’s ₦2.9 billion losses to the coordinated attacks on government payment infrastructure in 2026, these cases expose weak security practices as much as exposed data.
This article examines six real Nigerian data breach and enforcement cases from 2023 through 2026, what went wrong in each, and what the Nigeria Data Protection Act (NDPA) 2023 expects businesses to do about it.
The Scale of the Problem
Data breaches in Nigeria are no longer occasional headlines. Independent monitoring recorded at least 119,000 compromised Nigerian accounts in the first quarter of 2025 alone, with the figure passing 150,000 by mid-year. Over the same period, the Nigeria Data Protection Commission (NDPC) opened sector-wide probes into more than 1,300 organisations, ordering proof of compliance within 21 days.
Enforcement has accelerated alongside the incidents. NDPC penalties collected through 2025 ran into the billions of naira, and the regulator has said it intends to keep ramping up enforcement. The cases below span multiple sectors, and each one lines up with something specific the NDPA expects businesses to get right.
Case Studies: What Six Nigerian Incidents Reveal
| Case | Year | Sector | What Failed |
|---|---|---|---|
| Flutterwave | 2023 | Fintech | Segregation of duties, transaction monitoring |
| UBA | 2023 | Banking | Insider access controls |
| Sterling Bank | 2025 and 2026 | Banking | Vendor risk, then external perimeter security |
| NIMC | 2023 | Government identity | Unsecured API authentication |
| BestFin Nigeria | 2024 | Digital lending | Data minimisation, purpose limitation |
| CAC, Remita, EFCC | 2026 | Government infrastructure | Coordinated multi-agency exposure |
Flutterwave: Internal Controls Under Scrutiny
In 2023, Flutterwave found itself in the news when over ₦2.9 billion moved through the platform in unauthorised transactions. The company denied a traditional breach, but court filings showed insiders had exploited workflow vulnerabilities to reroute funds.
Weak segregation of duties, gaps in monitoring and audit trails, and the absence of automated alerts for unusual transactions all contributed. Delayed communication with stakeholders worsened the impact once the incident became public.
The NDPA isn’t limited to external breaches. It expects businesses to secure internal systems and monitor access, particularly where sensitive data or funds are involved, and this case shows why.
UBA: When Insider Access Becomes a Liability
UBA’s incident showed that the biggest threat to an organisation isn’t always external. Staff members with legitimate system access manipulated backend systems to divert funds, and a separate legal case shows Nigerian courts have already awarded damages in comparable data privacy breaches.
Insufficient oversight of employee access, no regular audits of access patterns, and missing behavioural analytics to flag anomalies were the core gaps. Insider threats remain one of the biggest risks facing Nigerian banks, and the guide to insider threats in Nigeria covers the broader pattern.
The NDPA holds businesses accountable for how well they oversee their own staff. Where employees hold access to personal or financial data, the law expects role separation, training, and tools that track internal activity rather than perimeter defences alone.
Sterling Bank: Two Breaches, Eighteen Months Apart
Sterling Bank’s story is really two stories, and the gap between them is the lesson. In January 2025, police filings alleged that external actors, working in collusion with some staff, compromised Sterling’s systems and diverted roughly ₦1.2 to ₦1.3 billion.
A leaked spreadsheet appeared to trace back to a third-party system; Sterling denied wrongdoing, but the incident raised renewed questions about vendor risk management.
Then, in April 2026, Sterling was hit again, this time from outside. A threat actor calling itself ByteToBreach claimed responsibility for accessing roughly 900,000 customer accounts and 3,000 employee records, including BVNs and NINs.
Two breaches at the same institution within eighteen months, one involving insider collusion and vendor weaknesses, the other an external compromise, show why organisations need layered security rather than fixes aimed at a single attack path.
NIMC: A Government API Left Wide Open
In late 2023, cybersecurity researcher Ayanbe Francis Uzezi demonstrated that personal identity records could be queried through unsecured APIs linked to the National Identity Management Commission (NIMC).
NIMC denied a direct breach, but the demonstration exposed real lapses: APIs had been left without proper authentication checks.
National ID data is among the most sensitive information any government holds, and this case showed that even government systems carry critical vulnerabilities. The NDPA expects organisations to safeguard any access point that could retrieve personal data, including those used by third parties or external developers, whether or not a breach is formally confirmed.
BestFin Nigeria: When a Loan App Collects More Than It Needs
In July 2024, researchers at Cybernews discovered an unsecured, publicly accessible database belonging to BestFin Nigeria, operator of the iCredit loan app. The 300GB database held records on 846,000 customers, no password required.
What made this case unusual, beyond the exposure itself, was what the company had been collecting in the first place: full SMS message histories, including personal conversations unrelated to loan repayment, OTP codes, BVN validation logs, contact lists, installed-app lists, and emergency contact details.
Cybernews flagged the leak on July 4; the database wasn’t secured until August 26, over seven weeks later.
Every other case here centres on a security control failing: insider abuse, external attackers, or an unsecured API. BestFin’s failure came earlier. The app collected data it had no legitimate business reason to hold.
The NDPA’s consent and purpose-limitation requirements exist precisely to stop this kind of collection before it becomes a breach waiting to happen. Digital lending apps, given a well-documented pattern of contact-list harassment and loan-shaming in Nigeria, are a sector regulators are watching closely.
CAC, Remita, and the EFCC: A Coordinated Hit on Government Systems
The most consequential recent case isn’t a single incident but a wave. In April 2026, the Corporate Affairs Commission (CAC), the government payment platform Remita, and the Economic and Financial Crimes Commission (EFCC) were all compromised within a three-week window.
A threat actor called ByteToBreach claimed responsibility for the Remita breach, advertising roughly 3TB of stolen data on a criminal forum; a separate group calling itself Nullsec Nigeria claimed responsibility for the EFCC compromise.
The NDPC opened an investigation into the CAC breach the same day it was confirmed. The federal government has since established a coordination council, the Ministerial Advisory Council for Cybersecurity Coordination (NG-MACC), bringing NITDA, the Nigerian Communications Commission, and the NDPC together to respond to cross-sector threats.
What makes this case distinct is the target profile: not isolated companies but the infrastructure government agencies and citizens rely on directly, the corporate registry, the salary and treasury payment backbone, and the anti-corruption enforcement agency itself, hit in close succession.
Patterns Across These Cases
A few patterns repeat across sectors and years. Internal access controls are consistently the weakest link. From Flutterwave to UBA to Sterling Bank’s first incident, insider access and collusion drove the largest losses, and most Nigerian businesses still lack proper segregation of duties and monitoring.
Insider collusion combined with external attacks creates far greater risk than either alone. Sterling Bank’s case showed how quickly that combination turns ordinary control gaps into catastrophic ones, and security needs to account for both directions at once rather than treating them as separate problems.
APIs are routinely left under-secured. The NIMC case exposed something security researchers already knew: Nigerian organisations frequently deploy APIs without proper authentication or monitoring, including government systems.
Detection often comes too late. In nearly every case here, the breach was discovered weeks or months after it occurred, and real-time monitoring remains rare among Nigerian SMEs specifically.
That delay is often the difference between a contained incident and a six-figure loss; the guide to responding to data breaches in Nigeria covers what the first hours and days of a response should look like.
What the NDPA Expects
These cases reveal what went wrong, and what the law expects in response. The NDPA doesn’t demand perfection, but it does demand accountability, and its enforcement record now backs that up.
Consent has to be explicit and specific, not buried in a form nobody reads, and it doesn’t extend to data a business has no legitimate reason to collect in the first place, exactly what went wrong at BestFin.
Systems need to be secured from the inside out. Role-based access controls, encryption for data at rest and in transit, regular security audits, and vendor security assessments all matter, because the NDPA holds a business responsible for any point where data can be misused or leaked, including third-party access.
Incident reporting has a hard deadline. Organisations must notify the NDPC within 72 hours of becoming aware of a breach and notify affected individuals without undue delay where the risk is high.
That means incident response plans, escalation procedures, and a designated data protection officer need to exist before an incident, not after. The guide to data protection officers in Nigeria covers what that role actually requires.
Training has to be ongoing rather than a one-time exercise, covering data-handling procedures, social engineering recognition, and incident-reporting steps.
The General Application and Implementation Directive (GAID) replaced the older Nigeria Data Protection Regulation (NDPR) as the operative compliance standard in September 2025. The GAID Compliance Checklist covers the audit framework it introduces.
These obligations don’t stop applying the moment a business closes. Data lifecycle management matters just as much: organisations should collect only what they need, retain it only as long as necessary, and dispose of it responsibly, documented, implemented, and reviewed rather than existing only on paper.
The closure of BuyCoins Pro in 2024 highlighted exactly this point, since the NDPA continues to govern how data is handled during wind-down, not only while a company is operating.
Penalties are no longer theoretical. For data controllers of major importance, the NDPC can impose fines up to ₦10 million or 2% of annual gross revenue, whichever is higher.
In July 2025, the NDPC fined MultiChoice Nigeria ₦766,242,500 for unlawful cross-border transfer of subscriber and non-subscriber data, after finding the company’s remediation response “unsatisfactory.”
Separately, the NDPC’s February 2025 fine against Meta, $32.8 million over data practices affecting more than 60 million Nigerians, was controversially set aside through a confidential settlement in late 2025. Nigeria’s data privacy lawyers formally objected to the lack of transparency around that decision.
The guide to the Nigeria Data Protection Commission covers its powers and enforcement record in more depth.
Beyond regulatory penalties, businesses face civil liability, reputational damage, and a loss of customer trust that can take years to rebuild.
Quick Compliance Check
A short self-check can surface the most common gaps before a regulator or an incident does:
- Is it clear exactly who has access to customer data, and is an audit report available on demand?
- Are vendors contractually obligated to follow NDPA rules, and is their compliance reviewed regularly?
- Could a data breach be detected and reported within 72 hours if it happened today?
- Is there a documented, tested process for securely deleting user data when services end or accounts close?
- Have staff received data protection training within the past year, and would they recognise a potential breach?
Answering “no” or “not sure” to two or more of these is a reasonable signal that a compliance audit should move up the priority list rather than wait for the next scheduled review.
How PlanetWeb Can Help
Most of the businesses in these cases didn’t fail because they ignored security entirely. They failed because a specific, ordinary gap- an unmonitored access path, an unaudited vendor, an API nobody revisited- went unaddressed until it was exploited.
PlanetWeb works with Nigerian organisations to assess where those gaps sit, from access controls and vendor risk to incident response readiness, and to build the documented compliance posture the NDPA now actively enforces. If you’d like a clearer picture of where your organisation stands, get in touch.
