Cybercriminals Target Nigeria: 13 Million Personal, Company Passwords Exposed Over Two Decades - Report Says

A new cybersecurity report has revealed that Nigeria recorded 281,500 leaked user accounts in the first quarter of 2026, placing the country 34th on the global list of most breached nations.

The findings, published by cybersecurity firm Surfshark, show that between January and March 2026, over 210.3 million accounts were breached worldwide. The United States accounted for the largest share 29% of all reported breaches followed by France, India, Brazil, and the United Kingdom.

Nigeria’s long-term exposure: The report provides a deeper look into Nigeria’s cybersecurity vulnerability over the past two decades. Since 2004, the country has recorded approximately 24.1 million compromised user accounts, making it the third most affected nation in Sub-Saharan Africa.

Surfshark further noted that 7.5 million unique email addresses linked to Nigerian users have been exposed over the years, alongside roughly 13 million leaked passwords. Consequently, 54% of breached Nigerian users now face elevated risks of account takeovers, identity theft, extortion, and other cyber-related crimes.

“Statistically, 10 out of 100 Nigerian people have been affected by data breaches,” the report stated.

Sensitive data exposed: The leaked information tied to Nigerian accounts includes highly sensitive personal and financial data. According to the analysis, about 3,900 Social Security-related records and 1,600 payment card details were exposed, along with 1.9 million phone numbers and over 925,000 residential addresses.

Global surge linked to AI adoption

Globally, the number of breached accounts in Q1 2026 tripled compared to the same period in 2025 and rose by 22% from the previous quarter. Surfshark’s Chief Security Officer, Tomas Stamulis, attributed this sharp rise to the rapid integration of artificial intelligence tools by businesses.

As more companies store larger volumes of user data and connect additional digital systems, AI-driven platforms collect detailed personal information for automation and analytics. While this improves efficiency, it also expands the number of systems requiring security, creating fresh opportunities for cybercriminals.

Stamulis warned that leaked personal data remains valuable to hackers for years even after users change compromised passwords or email addresses. Attackers often combine old and new leaks into “combo lists,” which can be repeatedly sold or used for fraud.

Precautionary measures: He advised users to share sensitive information only when absolutely necessary, consider using alternative email identities or masking services, and avoid oversharing personal details online.

What you should know: Just last month, the Nigeria Data Protection Commission (NDPC) raised concerns over coordinated cyber threats targeting the country’s financial systems and digital infrastructure. The Commission urged organisations handling personal data to urgently strengthen technical and organisational safeguards to protect Nigerians from rising privacy breaches and cyber risks.