In a troubling revelation, Paradigm Initiative (PI) has uncovered a data breach and several unauthorised websites are selling sensitive personal and financial data of Nigerian citizens for as little as ₦100.

PI refers to an investigative report by the Foundation for Investigative Journalism (FIJ) Nigeria on March 16, 2024, titled “ALERT: XpressVerify, a Private Website, Has Access to Registered Nigerians’ Data and Is Making Money From It.”

The report detailed how the website, www.XpressVerify.com.ng, was accessing and commercialising the personal data of Nigerian citizens for profit.

Anybody can retrieve details such as phone numbers, full names, NIN, addresses and photographs of any Nigerian whose data is on the National Identity Database for as low as ₦200.

PI also reports about another website, AnyVerify.com.ng, operating since November 2023, involved in the commercial distribution of personal data.

The site offers a range of services, including access to National Identity Numbers (NIN), Bank Verification Numbers (BVN), driving licenses, international passports, company details, Tax Identification Numbers (TIN), Permanent Voter’s Cards (PVC), and phone numbers.

According to PI, each data request is sold for ₦100, and the website recorded 567,990 visits in February 2024 and 188,360 visits in April 2024, highlighting the extensive nature of this breach.

Given the gravity of the situation, Paradigm Initiative has stated it has served a pre-action notice to several government agencies, including the National Identity Management Commission (NIMC), Nigeria Data Protection Commission (NDPC), Nigeria Immigration Service (NIS), Federal Inland Revenue Service (FIRS), Central Bank of Nigeria (CBN), Independent National Electoral Commission (INEC), Federal Road Safety Corps (FRSC), and the Office of the Attorney General of the Federation (AGF).

What are the implications of the data breach?

The compromise of such data not only undermines the privacy of individuals but also makes them vulnerable to identity theft and fraud.

Economically, the ramifications of a data breach are substantial. Individuals may face financial losses due to fraudulent activities conducted with their stolen information. Large-scale breaches can disrupt economic activities, particularly if they impact critical sectors such as banking, healthcare, and government services.

In Nigeria, data breaches, particularly involving data owned and accumulated by government agencies, are governed primarily by the Nigeria Data Protection Regulation 2019. The NDPR, enforced by the National Information Technology Development Agency (NITDA), outlines the obligations of data controllers and processors, and the implications of data breaches:

Operational impact:

• Disruption of services: Data breaches can disrupt the operations of government agencies, leading to service interruptions and operational inefficiencies.
• Data security enhancements: Post-breach, agencies may need to invest significantly in enhancing their data security measures, conducting audits, and implementing stricter compliance protocols.

Legal framework and enforcement

• NITDA’s Role: NITDA is responsible for enforcing the NDPR and ensuring compliance by private and public sector entities. It provides guidelines, conducts audits, and imposes penalties for non-compliance.
• Collaboration with other agencies: NITDA collaborates with other regulatory bodies, such as the Central Bank of Nigeria (CBN) for financial institutions, to ensure a comprehensive approach to data protection.