The Nigeria Data Protection Commission (NDPC) has launched an investigation into an alleged data breach involving Remita Payment Services Ltd. and Sterling Bank.
The probe, which commenced on April 1, 2026, is aimed at determining whether the personal and financial data of millions of Nigerians have been compromised within the country’s digital payment ecosystem.
In a statement released on Sunday, the Commission’s Head of Legal, Enforcement and Regulations, Babatunde Bamigboye, confirmed that a formal notice had been served on the affected organisations.
“In line with the Commission’s procedure, Notice of Investigation was duly served on the 1st of April, 2026. Relevant parties and individuals have been providing information for the purpose of addressing the incident,” the statement read.
The NDPC said it is currently interrogating relevant parties to determine the nature and scope of the alleged breach, as well as the risks posed to data subjects.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.
“The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed,” the Commission stated.
The National Commissioner and Chief Executive Officer of the NDPC, Vincent Olatunji, has directed that the investigation be expanded to include other organisations operating within the digital payment space.
He warned that any entity found to have failed in implementing adequate data protection measures would face sanctions under the law.
The Commission noted that under the Nigeria Data Protection Act 2023, organisations are required to implement strict technical and organisational safeguards to protect users’ data.
Olatunji emphasised that enforcement would be part of a broader effort to safeguard the integrity of Nigeria’s digital ecosystem.
The development follows recent claims by a dark web hacker identified as “Bytetobreach,” who alleged responsibility for breaching systems linked to the fintech firm.
The hacker reportedly claimed access to sensitive data, including Bank Verification Numbers, account details, identification documents, transaction histories, and employee records.
In March, similar claims were made regarding an alleged breach involving Sterling Bank, with reports suggesting that up to one million customer accounts and thousands of staff records may have been exposed.
Remita and Sterling Bank are key players in Nigeria’s financial ecosystem, handling large volumes of transactions across the government and private sectors.
The outcome of the investigation is expected to have far-reaching implications for data protection compliance and consumer trust in the country’s rapidly evolving digital economy.
The NDPC reiterated its commitment to protecting Nigerians’ personal data and ensuring that organisations adhere strictly to established data protection standards.
