The Nigeria Data Protection Commission (NDPC) said it has launched an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other entities.
In a statement issued on Sunday and signed by its Head, Legal, Enforcement and Regulations, Babatunde Bamigboye, the need for a probe followed reports of a suspected cyberattack circulating on dark web forums, where threat actors claimed to have accessed and exposed sensitive customer and institutional data linked to the platforms.
The development has since raised concerns over potential risks to data subjects and the integrity of Nigeria’s digital payment ecosystem.
The NDPC said its probe, which commenced with the service of a Notice of Investigation on April 1, 2026, is focused on determining the scope of the incident, the categories of personal data affected, and the potential risks to data subjects.
Relevant parties and individuals are already providing information to support the inquiry and address the situation, according to the statement.
The commission stated that the investigation would also assess the technical and organisational safeguards in place, as well as the mitigation measures adopted in the event of a confirmed breach.
“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.
“The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed,” the commission said.
The National Commissioner and Chief Executive Officer of NDPC, Dr Vincent Olatunji, said he has also directed a broader review of organisations deploying digital payment systems to ensure compliance with the Nigeria Data Protection Act, 2023.
He said entities found to be operating without adequate data protection measures would be scrutinised as part of efforts to safeguard the integrity of Nigeria’s digital ecosystem.
Sterling Bank and Remitta are yet to release official statements on the allegation.
The development followed the Commission’s launch of an investigation into the global e-commerce platform Temu in February over alleged breaches of the country’s data protection law.