The Nigeria Data Protection Commission (NDPC) has commenced an investigation into an alleged breach of personal and financial data involving Remita Payment Services Limited and Sterling Bank, raising fresh concerns over cybersecurity vulnerabilities in Nigeria’s digital payment ecosystem.
The commission disclosed on Sunday that the probe, triggered on April 1, 2026, is aimed at determining whether sensitive information belonging to millions of Nigerians may have been compromised.
In a statement signed by the Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, the NDPC confirmed that notices of investigation had been served on the affected organisations, while relevant individuals are currently being interrogated.
He said, “In line with the commission’s procedure, notice of investigation was duly served on April 1, 2026. Relevant parties and individuals have been providing information for the purpose of addressing the incident.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.”
According to the commission, the investigation will examine the nature and scope of the alleged breach, the categories of data involved, potential risks to affected individuals, and the mitigation steps taken where violations are established.
The National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, has also ordered a broader review of organisations operating within Nigeria’s digital payment space, warning that firms found to have failed in implementing adequate safeguards would face sanctions under the Nigeria Data Protection Act, 2023.
The development follows claims by a suspected cybercriminal identified as “ByteToBreach,” who alleged breaches involving both firms.
The hacker reportedly claimed access to about one million customer accounts and thousands of employee records linked to Sterling Bank, including sensitive data such as Bank Verification Numbers, account details, identification documents, transaction histories and credit information.
Similar claims were also made against Remita, a widely used payment gateway for government and private sector transactions.
While the allegations are yet to be officially confirmed by the affected organisations, the NDPC said the ongoing probe is part of a wider effort to safeguard the integrity of Nigeria’s data protection framework and ensure compliance across the financial technology ecosystem.
The latest move underscores growing regulatory scrutiny amid rising cases of cyber threats targeting Nigeria’s financial institutions.
In recent enforcement actions, the commission had imposed heavy sanctions on organisations found guilty of data protection violations, signalling a tougher stance on compliance.
'
'Do you want to share a story with us? Do you want to advertise with us? Do you need publicity for a product, service, or event? Contact us on WhatsApp +2348183319097 Email: platformtimes@gmail.com
We are committed to impactful investigative journalism for human interest and social justice. Your donation will help us tell more stories. Kindly donate any amount HERE
