The Nigeria Data Protection Commission (NDPC) says it has launched an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank and other entities.
This follows reports of a suspected cyberattack circulating on dark web forums, where threat actors claimed to have accessed and exposed sensitive customer and institutional data linked to the platforms, raising concerns over potential risks to data subjects and the integrity of Nigeria’s digital payment ecosystem.
The NDPC said its probe, which commenced with the service of a Notice of Investigation on April 1, 2026, is focused on determining the scope of the incident, the categories of personal data affected and the potential risks to data subjects.
In a statement issued on Sunday and signed by its Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, the NDPC said relevant parties and individuals are already providing information to support the inquiry and address the situation.
The commission stated that the investigation would also assess the technical and organisational safeguards in place, as well as the mitigation measures adopted in the event of a confirmed breach.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.
“The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed,” the commission said.
The National Commissioner and Chief Executive Officer of NDPC, Dr Vincent Olatunji, said he has also directed a broader review of organisations deploying digital payment systems to ensure compliance with the Nigeria Data Protection Act, 2023.
He said entities found to be operating without adequate data protection measures would be scrutinised as part of efforts to safeguard the integrity of Nigeria’s digital ecosystem.
