NDPC Investigates Remita and Sterling Bank Data Breach

The Nigeria Data Protection Commission (NDPC) has launched a formal investigation into Remita Payment Services Ltd and Sterling Bank following reports of a potential large-scale data breach. This breach may have exposed sensitive personal financial information of thousands of Nigerians.

The NDPC confirmed the investigation in a statement signed by Babatunde Bamigboye, Head of Legal Enforcement. The inquiry will assess the technical measures both organizations have in place to safeguard user data.

Reports indicate that Remita's system may have leaked 3 terabytes of data, including 800GB of KYC documents, while Sterling Bank is linked to the exposure of data from approximately 900,000 customer accounts. The Nigeria Data Protection Act 2023 mandates organizations to implement strong technical measures to protect personal data, with non-compliance resulting in penalties of up to N10 million or 2% of annual gross revenue.

The NDPC has already launched a sector-wide compliance review covering 1,369 organizations, including 795 financial institutions.