The Dark Web and Nigerian Data: What Hackers Already Know About You

Most Nigerians have never visited the dark web. But their data almost certainly has.

Research by CYFIRMA in 2025 found active listings on dark web and Russian-language forums selling Nigerian banking databases, telecom subscriber records, BVN-linked identities, and government employee data. One listing claimed over 60 million Nigerian phone records. Another offered access to a Nigerian bank’s internal database for $330 — price negotiable.

What Nigerian Data Is Being Sold Right Now

• Banking records: Including Chartered Institute of Bankers of Nigeria member data and internal access to multiple commercial banks.
• Telecom subscriber data: Claims of 60+ million records, including names, phone numbers, and addresses.
• Government agency data: Internal records from the Nigerian Navy and the Lower Niger River Basin Development Authority.
• Healthcare data: 130,000 patient records exposed in one breach.
• Corporate payroll data: Employee records from the Princeps Credit Systems ransomware attack by Killsec (September 2025).

How Your Data Gets There

• Direct breach: A company you use gets hacked. Your records are stolen.
• Credential stuffing: You reused a password. One breach exposes it. Attackers test it against your bank.
• Phishing: You clicked a fake bank SMS link. Related: A Way to Access Google Accounts Without a Password (dst.com.ng).
• Third-party exposure: A vendor or partner that holds your data gets breached without your knowledge.

How to Check and Respond

1. Check if your email has been breached. Visit haveibeenpwned.com — a free, legitimate service.
2. Change affected passwords immediately.
3. Monitor your BVN activity via your bank or the CBN-approved BVN portal.
4. Be sceptical of callers with your data — knowing your name and bank does not make them legitimate.

The Regulatory Context

Nigeria passed the Nigeria Data Protection Act (NDPA) in 2023, giving the NDPC powers to enforce data breach notification. Organisations must notify the NDPC within 72 hours of a breach. Lagos State went further in April 2026, releasing comprehensive cybersecurity guidelines for businesses aligned with the NDPA (P.M. News, April 2026).