Top 7 High-Profile Data Breaches Targeting Key Institutions in Nigeria since 2024

This Video Is Trending Right Now →

By Boluwatife Oshadiya

Source Credit: Compiled and adapted from an internal investigative brief provided for editorial development (BizWatch Nigeria newsroom standards).

KEY POINTS

• Nigeria recorded a surge in major cyberattacks between 2024 and 2026 across banking, fintech, and government systems.
• Ransomware, cloud misconfigurations, and credential leaks were the dominant attack vectors.
• Millions of sensitive records—including BVNs, NINs, corporate filings, and financial data—were allegedly exposed.
• A recurring threat actor alias, ByteToBreach, is linked (directly or indirectly) to multiple incidents.
• Regulatory bodies such as the NDPC and NITDA have intensified investigations and advisories.
• The breaches raise systemic concerns about Nigeria’s digital infrastructure resilience ahead of the 2027 elections.

MAIN STORY

Nigeria’s digital economy is facing one of its most sustained cybersecurity challenges in recent years. Between 2024 and 2026, a wave of ransomware attacks, data leaks, and system compromises has exposed critical weaknesses in both public and private sector digital infrastructure.

At the center of multiple incidents is an emerging threat pattern linked to an alleged actor known as ByteToBreach, described by analysts as a technically adaptive operator leveraging leaked credentials, AI-assisted tools, and unpatched system vulnerabilities rather than traditional organized cybercrime structures.

From financial institutions to regulatory agencies, the scale of exposure has triggered growing concern around data sovereignty, financial system integrity, and national security readiness in an increasingly digitized economy.

Below is a structured listicle of the seven most significant cybersecurity breaches and incidents affecting Nigeria between 2024 and 2026, based strictly on available incident descriptions and disclosed reports.

1. Sterling Bank Ransomware Breach (March 2026)

The Sterling Bank breach is widely regarded as one of the most severe financial-sector cyber incidents in the period under review.

• Type: Ransomware + data exfiltration
• Scale: ~900,000 customer records + 3,000 employee records
• Alleged Actor: ByteToBreach

What was exposed

Sensitive personal and financial identifiers reportedly included:

• BVN data
• National Identity Numbers (NIN)
• Passport details
• Internal employee records

Impact

The attackers allegedly demanded ransom in the region of €250,000, with threats of public data release. The incident is also believed to have created downstream risks through credential reuse across other systems.

2. Remita Payment Platform Breach (April 2026)

Remita, a core infrastructure platform for government payments, was reportedly compromised shortly after the Sterling Bank incident.

• Type: Cloud misconfiguration + ransomware exploitation
• Data volume: ~3TB
• Alleged Actor: ByteToBreach

What was exposed

• Government salary payment systems
• Tax remittance data
• Public sector financial transaction records

Entry vector

Investigations point to a misconfigured cloud storage bucket (Amazon S3), allegedly accessed through compromised or reused credentials.

Impact

The incident raised major concerns about cloud governance practices within Nigeria’s public financial systems and triggered regulatory scrutiny.

3. Corporate Affairs Commission (CAC) Data Breach (April 2026)

The CAC breach is among the most structurally sensitive incidents due to the nature of corporate registry data exposed.

• Type: Ransomware + administrative system compromise
• Scale: ~25 million documents (~750GB)
• Alleged Actor: ByteToBreach

What was exposed

• Company registration documents
• Ownership structures
• Identity documents and signatures
• Corporate filing records

Impact

The CAC temporarily suspended its online portal and issued warnings about potential phishing risks targeting businesses and individuals.

4. Princeps Credit Systems Ransomware Attack (September 2025)

A major micro-lending institution serving tens of thousands of Nigerians was hit by ransomware attributed to the Killsec group.

• Type: Full system compromise
• Scale: 70,000+ clients affected

What was exposed

• Customer financial data
• Employee records
• Lending operations database

Impact

With reported loan disbursements of approximately ₦25 billion, the breach significantly impacted trust in digital lending ecosystems and increased regulatory scrutiny.

5. National Bureau of Statistics (NBS) Website Defacement (December 2024)

Unlike financially motivated attacks, this incident was largely symbolic but still disruptive.

• Type: Website defacement
• Attacker: Unknown

What happened

The official NBS website was defaced and replaced with a “Page Hacked” message, rendering it inaccessible for weeks.

Impact

Although no confirmed large-scale data theft was reported, the timing raised concerns due to its proximity to sensitive statistical releases, suggesting possible politically motivated intent.

6. Flutterwave Financial Systems Incident (April 2024)

One of Africa’s largest fintech platforms experienced suspicious financial movements that raised security concerns across the sector.

• Type: Financial system exploitation
• Scale: ~₦11 billion in unauthorized transfers

What happened

Funds were reportedly routed through multiple accounts over a four-day period.

Company position

Flutterwave stated that customer funds and personal data were not ultimately lost, but acknowledged the incident highlighted vulnerabilities in transaction monitoring systems.

Impact

The case intensified regulatory pressure on fintech security frameworks across Africa’s digital payments ecosystem.

7. Federal Housing Authority (FHA) Data Leak (Alleged, Unverified)

This remains the most recent and least confirmed incident but is notable due to the sensitivity of the alleged exposure.

• Target: Federal Housing Authority (fha.gov.ng)
• Type: Alleged internal data leak
• Claimed size: ~70MB–100MB compressed datasets
• Attributed group: “Nullsec Philippines x Nullsec Nigeria” (self-identified)

Alleged contents

• Backend system files
• Configuration files
• Source code

Why it matters

If verified, exposure of system-level files could potentially reveal:

• Database credentials
• API keys
• Internal architecture details

Assessment

• Credibility: Medium–High (based on structured leak presentation)
• Verification: Unconfirmed

THE ISSUES

Across all seven incidents, several structural vulnerabilities emerge in Nigeria’s digital infrastructure:

• Widespread cloud misconfiguration risks, particularly storage mismanagement
• Weak credential hygiene and reuse practices across institutions
• Rapid digitisation without proportional cybersecurity investment
• Limited real-time endpoint detection and response systems
• Increasing use of automation and AI tools by threat actors

Cybersecurity estimates suggest Nigeria may have lost over $3 billion to cybercrime between 2019 and 2025, with attacks accelerating sharply in financial services and government sectors.

WHAT’S BEING SAID

Regulatory agencies including the Nigeria Data Protection Commission (NDPC) and NITDA have stepped up investigations, advisories, and compliance enforcement across affected sectors. Industry analysts broadly agree that the incidents reflect a shift from isolated cyberattacks to more coordinated exploitation of systemic weaknesses.

However, there is also a growing consensus among cybersecurity experts that regulatory response alone is insufficient without:

• Mandatory cybersecurity audits for critical infrastructure
• Stronger cloud security governance frameworks
• Centralized incident response coordination
• Real-time intelligence sharing between institutions

WHAT’S NEXT

Nigeria’s cybersecurity landscape is expected to become more tightly regulated as digital dependence grows across banking, governance, and public services.

Key developments likely to shape the next phase include:

• Expansion of national cyber incident reporting requirements
• Increased scrutiny of fintech and cloud service providers
• Possible reforms to critical infrastructure protection standards
• Greater investment in cybersecurity workforce development

With elections approaching in 2027 and digital systems becoming central to both governance and commerce, pressure is mounting on institutions to shift from reactive containment to proactive cyber resilience.

BOTTOM LINE

The 2024–2026 cybersecurity incidents are no longer isolated technical failures—they represent a broader structural exposure within Nigeria’s digital ecosystem. From banking platforms to corporate registries and government infrastructure, the attack surface is expanding faster than defensive systems are evolving. The central challenge now is not just preventing breaches, but fundamentally re-architecting digital trust frameworks across critical national systems before the risks scale further.