First Half Cyber Breaches in Nigeria and What They Mean

What Nigeria’s data breaches in the first half of 2026 tell us about credentials, and why the fix is structural

Trustaige ID · Lagos · July 6, 2026

In the space of a few weeks in the spring of 2026, a single threat actor moved from a bank, to the payment rails that carry government salaries, to the registry that holds the legal identity of every company in Nigeria. The through-line connecting those attacks was not some exotic zero-day. In case after case, it was the oldest weakness in security: a credential that should not have worked, working.

At Trustaige, workforce identity is what we build, so we watch these patterns closely. And the first half of 2026 in Nigeria reads less like a run of bad luck and more like a lesson that’s now impossible to ignore.

The numbers behind the headlines

According to a Q1 2026 breach analysis by the cybersecurity firm Surfshark (reported by Nairametrics), Nigeria recorded roughly 281,500 breached accounts in the first quarter alone — ranking it the 34th most-affected country globally in that period. The same analysis put Nigeria at around 24.1 million accounts compromised since 2004, among the most affected in Sub-Saharan Africa.

Those are national aggregates. The individual incidents that drove the year are more instructive, because they show how the exposure actually happens.

A three-week chain: Sterling Bank, Remita, and the CAC

The defining story of H1 2026 was a connected sequence of attacks attributed to a threat actor operating as ByteToBreach, reported across Nigerian media through late March and April. The order of events is the point.

Sterling Bank (late March 2026)

ByteToBreach claimed responsibility for an attack on Sterling Bank, reportedly accessing around 900,000 customer accounts and roughly 3,000 employee records. The exposed material was reported to include highly sensitive national identifiers such as Bank Verification Numbers (BVNs), National Identity Numbers (NINs) and passport data. On its own, that is a serious breach. But it was the pivot that followed that turned a bank incident into a national one.

Remita (late March 2026)

From the bank, the attacker pivoted to Remita, which is the payment platform that processes salaries, taxes and payments across large parts of the Nigerian public and private sector. Reporting indicated the Remita exposure allegedly stemmed from a misconfigured Amazon S3 cloud storage bucket, exposing a reported three terabytes of data. That technical detail matters: a misconfigured storage bucket is not a feat of sophisticated hacking. It is, as security practitioners put it, a failure of data-asset management by humans and organisations.

The Corporate Affairs Commission (April 2026)

The chain culminated in an attack on the Corporate Affairs Commission (CAC), the agency that registers companies in Nigeria. Reports described the alleged exfiltration of some 25 million documents, around 750GB, with a large share representing substantive corporate records. The CAC temporarily suspended its company registration portal, and the Nigeria Data Protection Commission (NDPC) opened a probe.

Why the sequence matters more than any single breach

A bank, a payments backbone, and the national company registry are very different institutions with very different systems. What links them is that, once an attacker holds valid credentials and access, the boundary between one organisation and the next becomes porous. The exposure of identifiers like BVNs and NINs in one breach becomes raw material for impersonation and fraud against the next. Identity is the connective tissue of the damage.

The regulator is now asking for exactly this

The scale of the H1 attacks put the NDPC squarely in the spotlight. Following the financial-sector breaches, the Commission served formal notices reported to be dated 1 April 2026 and launched investigations; it opened a separate probe into the CAC breach later that month. It also issued a public advisory on escalating threats to the country’s data-security architecture.

The advisory is striking for how closely it maps to a modern identity playbook. Among the measures the NDPC urged data controllers and processors — including government ministries, departments and agencies — to adopt were:

• Robust identity and access controls, including multi-factor authentication (MFA);
• A zero-trust security architecture and network segmentation;
• Secure handling of cloud infrastructure, APIs, databases and access credentials;
• Encryption, key management and secure credential handling;
• Duly trained and certified Data Protection Officers, privacy policies, and regular vulnerability assessments.

And the backdrop has teeth: under the Nigeria Data Protection Act, organisations face a 72-hour breach-notification obligation, with enforcement intensifying through 2025 and 2026. Being unprepared is now both a security problem and a compliance liability.

The pattern: credentials are the attack surface

Across the H1 2026 events, the recurring enabler was identity: stolen, exposed, misconfigured or over-trusted credentials and access. Independent industry commentary through the period echoed the same conclusion: analyses cited by Nigerian outlets have repeatedly noted that the large majority of breaches involve compromised credentials, and that identity has become the primary attack surface.

Here’s the uncomfortable truth for any organisation running its workforce on passwords: a single valid credential, in the wrong hands, is often all that separates a contained network from a catastrophic one. Passwords can be phished, reused, guessed and traded. Once captured, they let an attacker log in rather than break in — and, as the Sterling → Remita → CAC chain showed, move from one system to the next.

What actually breaks the chain

If credentials are the problem, then the remedy is to make credentials worth far less to an attacker. Three shifts, all consistent with the NDPC’s own advisory and with open security standards, do most of the work.

1. Move from passwords to phishing-resistant authentication

Passkeys and other FIDO2/WebAuthn-based methods replace a shared secret (something you know, which can be stolen) with a cryptographic key bound to a device (something you hold, which cannot be phished in the same way). A credential that never exists as a re-usable secret cannot be captured on a fake login page or sold on a forum. This is the single highest-leverage change most organisations can make.

2. Adopt zero trust and device trust

Verifying every access request on the basis of identity, device posture and context, rather than network location. This directly limits the lateral movement that turned single breaches into chains in H1 2026. The NDPC named zero-trust architecture explicitly.

3. Make access provable: audit and least privilege

An immutable record of who accessed what, when, is what lets an organisation answer the NDPC’s questions inside the 72-hour window, and what limits the blast radius when something does go wrong. Combined with least-privilege access, it turns a potential catastrophe into a contained, explainable event.

This is precisely what Trustaige ID is built to do: workforce identity built so a stolen credential can’t become a breach. Passwordless, device trust, and an immutable audit trail are all deployed in days, not quarters.

The takeaway for Nigerian enterprises

The first half of 2026 was not, at root, a story about unusually clever attackers. It was a story about ordinary weaknesses such as reusable credentials, over-trusted access, a misconfigured storage bucket, all exploited at scale against institutions the whole economy depends on. That is oddly encouraging, because ordinary weaknesses have known fixes.

The organisations that will navigate the rest of 2026 well are not the ones that hope to avoid ever being targeted. They are the ones that have made a stolen credential worthless, verified every access request, and can prove what happened when asked. In a year that has already shown how quickly one exposed identity becomes a national problem, that is the difference between an incident and a crisis.

Where is your workforce identity exposed?

Trustaige ID helps regulated and fast-moving organisations replace passwords with phishing-resistant workforce identity such as passkeys, device trust, federation and immutable audit. We’re offering a free identity-risk check for a limited number of teams this month. Book yours at trustaige.com.