Over 150,000 Nigerian email accounts were compromised in 2025, the highest in Africa, according to cybersecurity firm Surfshark.
Nigeria recorded the highest number of breached email accounts in Africa from Q2 2024 to Q2 2025, with over 150,000 accounts compromised in 2025 alone, according to a report by cybersecurity firm Surfshark.
FIJ’s analysis shows that more than 119,000 breaches occurred in Q1 2025 before a 73% drop in Q2. Since 2004, about 23.3 million Nigerian accounts have been exposed—7.3 million unique emails and 13 million passwords.
Despite the 2023 Data Protection Act mandating data breach disclosures and sanctions, enforcement remains weak. “Organisations must notify the NDPC within 72 hours of any breach,” the law states. However, incidents involving the Oyo State TESCOM and the Nigeria Immigration Service were quietly resolved without informing affected individuals.
A 2024 report also exposed websites selling Nigerians’ NINs, BVNs, and passport data for as low as ₦100. Despite these violations, there have been no significant sanctions beyond an August 2024 fine of ₦555.8 million against Fidelity Bank for data misuse.