Nigerian regulatory body investigates Remita and Sterling Bank following claims of sensitive information leak

The Nigeria Data Protection Commission has initiated an inquiry into a suspected data breach affecting Remita Payment Services Ltd., Sterling Bank, and other entities, following reports of a cyberattack on dark web forums where threat actors claimed to have accessed sensitive customer and institutional data.

n

This development has sparked concerns over potential risks to data subjects and the integrity of Nigeria's digital payment ecosystem, prompting the NDPC to launch a probe that commenced with the service of a Notice of Investigation on April 1, 2026.

n

The investigation aims to determine the scope of the incident, the categories of personal data affected, and the potential risks to data subjects, with relevant parties and individuals already providing information to support the inquiry.

n

In a statement issued on Sunday and signed by its Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, the NDPC outlined its objectives, which include assessing the technical and organisational safeguards in place, as well as the mitigation measures adopted in the event of a confirmed breach.

n

The commission's primary goal is to ensure that data subjects are protected with appropriate technical and organisational measures, according to the NDPC, which is also examining the types of personal data involved, the nature and scope of the alleged breach, and the risk to data subjects.

n

The National Commissioner and Chief Executive Officer of NDPC, Dr Vincent Olatunji, has directed a broader review of organisations deploying digital payment systems to ensure compliance with the Nigeria Data Protection Act, 2023.

n

Entities found to be operating without adequate data protection measures will be scrutinised as part of efforts to safeguard the integrity of Nigeria's digital ecosystem, according to Dr Olatunji.