The Nigeria Data Protection Commission (NDPC) has launched an investigation into an alleged data breach involving prominent financial technology firm Remita Payment Services Ltd. and Sterling Bank.
Newsonspot gathered that the probe, which was officially triggered on April 1, 2026, seeks to determine the extent to which the personal and financial data of millions of Nigerians may have been compromised through the digital payment ecosystem.
In a statement released on Sunday by the Commission’s Head of Legal, Enforcement, and Regulations, Babatunde Bamigboye, Esq., the NDPC confirmed that “Notice of Investigation” has already been served on the affected entities.
The Commission revealed that relevant parties and individuals are currently being interrogated to address the incident and identify the “nature and scope” of the alleged breach.
The NDPC noted that the primary goal of the investigation is to ensure that “data subjects” (the Nigerian public) are protected by appropriate technical and organizational measures as required by law.Nigeria politics analysis
The statement partly read: “In line with the Commission’s procedure, Notice of Investigation was duly served on the 1st of April, 2026. Relevant parties and individuals have been providing information for the purpose of addressing the incident.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.
“The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed.”
According to the statement, the National Commissioner and CEO of the NDPC, Dr. Vincent Olatunji, has further directed that the probe be widened to include other organizations utilizing digital payment systems.
Under the Nigeria Data Protection Act (NDP Act) 2023, organizations are mandated to implement strict technical safeguards.
Olatunji warned that any entity found operating without these measures will face the full weight of the law as part of a “wider effort to ensure the integrity of the ecosystem.”
Remita, a major payment gateway used for government and private sector transactions, and Sterling Bank, a leading commercial lender, are central to Nigeria’s digital economy.
Last week, an emerging dark web hacker known as Bytetobreach claimed responsibility for breaching Remita, a major Nigerian payment processing platform.
In March, ByteToBreach claimed to have breached Sterling Bank, alleging access to approximately one million customer accounts and over 3,000 employee records.
The hacker asserted that sensitive data, including BVNs, NUBANs, passport and driver’s license details, transaction histories, loan records, credit scores, and employee information up to the CEO and Board Chairman, was compromised.
ByteToBreach further stated that all the data was hosted directly on Sterling Bank’s ASN infrastructure.
