NDPC Opens Probe into Remita, Sterling Bank

Nigeria’s data protection regulator has initiated an investigation into Remita Payment Services Limited and Sterling Bank Plc following reports of a suspected large-scale data breach that may have exposed sensitive personal and financial information of Nigerians.

The development was confirmed by the Nigeria Data Protection Commission in a statement signed by Babatunde Bamigboye, Head of Legal, Enforcement and Regulations. The Commission stated that a formal Notice of Investigation was served on both organisations on April 1, 2026, in line with established procedures.

According to the Commission, the probe is aimed at determining the nature and scope of the alleged breach, the categories of personal data involved, the level of risk posed to affected individuals, and the mitigation measures implemented where a breach is established. It noted that relevant parties have begun providing information to support the ongoing investigation.

Read Also:

• Zichis Agro-Allied Plans IPO as Investor Appetite Surges
• AfDB Approves $5.52m Grant to Support Tax Reforms in Nigeria, West Africa

The action follows a series of cyber threat alerts circulating online, suggesting that systems linked to both organisations may have been compromised. Reports from cyber intelligence sources alleged that a threat actor identified as “ByteToBreach” claimed responsibility for the incident.

A disclosure by Dark Web Informer on March 31 indicated that a large dataset associated with Remita had been leaked on a cybercrime forum. The report suggested that approximately 3 terabytes of data stored in cloud infrastructure may have been exposed, including more than 800 gigabytes of Know Your Customer documentation such as identity cards, passports, bank statements, and utility bills. Additional materials reportedly include internal databases, system logs, source codes, password hashes, and backup files.

In a separate alert, Hackmanac reported on March 27 that the same threat actor claimed to have breached systems belonging to Sterling Bank. The claim indicated that data relating to about 900,000 customer accounts and over 3,000 employee records may have been compromised. The information allegedly exposed includes banking details, identity records such as Bank Verification Numbers and passports, transaction histories, loan records, and credit scores.

Further reports circulating online suggest that the alleged breach may extend beyond the two institutions currently under investigation. Claims have indicated that data linked to Zenith Bank Plc, Oyo State Government, Leadway Assurance Company Limited, GetBumpa, and Ahmadu Bello University, among other entities, may also have been exposed, although the Commission has not confirmed these claims.

The investigation comes amid increasing adoption of digital financial services in Nigeria, raising concerns over the security of personal data handled by financial institutions and fintech platforms. Regulatory authorities have continued to emphasise the need for strict compliance with data protection standards, particularly for organisations managing sensitive user information.

Under the Nigeria Data Protection Act 2023, organisations are required to implement appropriate technical and organisational safeguards to protect personal data. Where breaches occur due to non-compliance, affected entities may face penalties of up to N10 million or 2 percent of their annual gross revenue, whichever is higher, alongside mandatory corrective measures.

The Commission stated that further updates will be provided as the investigation progresses.