Nigeria ranks 13th in Africa for per-capita data breach risk, with one compromised email account for every 1,337 people in the past year. The country also recorded the highest number of breached email accounts in Africa within the same period.

These details were disclosed by Surfshark, a global cybersecurity firm that has tracked breaches since 2004. FIJ analysed its database to observe breach trends from Q2 2024 to Q2 2025.

In 2025 alone, more than 150,000 Nigerian accounts have been compromised. Over 119,000 breaches occurred in the first quarter before dropping by 73% in the second quarter.

Since 2004, about 23.3 million Nigerian accounts have been exposed, including 7.3 million unique email addresses and 13 million passwords. This means roughly one in ten Nigerians has been affected.

In principle, Nigeria has a data protection agency and an enabling legislation. Nigeria’s Data Protection Act, in force since 2023, requires organisations to appoint a Data Protection Officer and maintain a written policy.

By Breached Count By People per Breach

Breached Emails

Nigeria 176,990 breaches

South Africa 71,449 breaches

Kenya 71,449 breaches

Ghana 24,993 breaches

Morocco 19,832 breaches

Egypt 17,892 breaches

Cameroon 15,347 breaches

Ethiopia 14,745 breaches

Algeria 11,180 breaches

Uganda 10,507 breaches

It also mandates data controllers to notify the Nigeria Data Protection Commission (NDPC) within 72 hours of any breach likely to harm individuals. They must also inform affected people if the impact could be severe. The Act replaced the 2019 Nigeria Data Protection Regulation.

Enforcement, however, is weak. The largest known fine the NDPC handed an entity came in August 2024 when it ordered Fidelity Bank to pay N555.8 million for processing personal data without consent.

It is not especially difficult to access the otherwise private data of people resident in Nigeria. Between June 2024 and July 2025, FIJ documented multiple breaches on state-controlled databases.

In July, a flaw in the Oyo State Teachers’ Service Commission portal exposed the names, emails and phone numbers of applicants and staff.

That same month, a loophole in the Nigeria Immigration Service’s passport appointment portal exposed Nigerians’ personal and biometric data. After FIJ’s stories, both flaws were fixed quietly without informing those affected.

In June 2024, FIJ and Paradigm Initiative reported how sites such as XpressVerify and AnyVerify were selling Nigerians’ National Identity Numbers, Bank Verification Numbers, passport and voter card details for N100 per search. These sites drew hundreds of thousands of visits before they were taken down.

None of these incidents has led to public sanctions or fines, despite clear provisions in Section 39 and Section 40 of the Data Protection Act requiring disclosure and protection of personal information. (Foundation For Investigative Journalism)