Despite a decline in the number of newly reported data breaches in recent months, Nigeria continues to rank among the most exposed countries globally in terms of compromised digital information. A recent report published by cybersecurity company Surfshark has revealed that over 13 million Nigerian passwords have been leaked over the years in multiple data breach incidents. This persistent exposure highlights deep-rooted challenges in the country’s cybersecurity ecosystem.
According to the mid-year 2025 report released on Thursday, more than 150,000 Nigerian user accounts were compromised in the first half of 2025 alone. The data shows a steep fall in the number of breaches between Q1 and Q2 from 119,000 in the first quarter to 31,800 in the second quarter, representing a 73% reduction. However, experts caution against interpreting the drop as a sign of stability, pointing instead to a broader historical context of digital vulnerability.
Since Surfshark began tracking global data breaches in 2004, Nigeria has recorded over 23.3 million compromised user accounts, placing it third in Sub-Saharan Africa after South Africa and Kenya. The cumulative nature of these incidents suggests long-standing structural weaknesses rather than isolated episodes.
Breakdown of the Impact
Among the breached data, the passwords linked to over 13 million Nigerian accounts were found to have been exposed. This means more than half of Nigeria’s compromised users are now at risk of identity theft, blackmail, phishing schemes, account hijacking, and unauthorized transactions. The report further notes that 7.3 million distinct Nigerian email addresses have been exposed to the public domain through various online leaks and breaches.
Surfshark’s findings estimate that approximately 10% of Nigeria’s population has been affected by one or more data breaches, based on the number of unique accounts compromised. That figure translates to about one in every ten Nigerians, pointing to a widespread and systemic cybersecurity concern.
“In today’s digital world, the more information we share, the greater the risk of it falling into the wrong hands,”
said Sarunas Sereika, product manager at Surfshark. He added that leaked data is commonly repurposed for identity fraud, sold on the dark web, or used in coordinated social engineering attacks.
Global Context: Breaches Continue to Rise Elsewhere
While Nigeria saw a marked decrease in breaches in Q2 2025, the global picture grew worse. Surfshark’s global data indicates that 94 million accounts were compromised in Q2, up from 70 million in Q1—a 34% increase. The United States topped the list with 42.5 million breached accounts, followed by France (11.4 million), India (1.7 million), Germany (1.3 million), and Israel (1.2 million).
When adjusted per capita, France showed the highest breach density, with 172 leaked accounts per 1,000 people, followed by Israel (130), the U.S. (123), Singapore (26), and Canada (24).
Nigeria’s Cybersecurity Gaps: Legal and Practical Issues
The report draws attention to Nigeria’s ongoing struggle to strengthen its digital security infrastructure. Although the Nigeria Data Protection Act was signed into law to improve personal data governance and introduce regulatory oversight, enforcement remains inconsistent. Additionally, low levels of cybersecurity awareness, repeated password use, and a lack of two-factor authentication (2FA) among users continue to expose individuals and institutions to preventable risks.
Surfshark’s conclusions were based on an analysis of over 29,000 publicly available breached databases. These datasets included anonymized user information such as email addresses, passwords, phone numbers, IP addresses, and other sensitive credentials. In many cases, these data leaks go undetected by users until criminal exploitation occurs.
The report underscores the need for both personal and institutional change. Surfshark notes that a large proportion of breaches could have been avoided with improved user behavior and stricter authentication systems. The company recommended the following key actions:
-
Avoid reusing passwords across multiple platforms.
-
Activate two-factor authentication for email, banking, and social media accounts.
-
Monitor personal data on breach notification platforms.
-
Institutions should invest in IT security audits and regular staff training.
As Nigeria’s economy continues to digitize, the reliance on online services will only increase. Without adequate digital safeguards, both individuals and businesses remain vulnerable to attack.
The findings are a reminder that cybersecurity is no longer a luxury, but a basic requirement for participation in today’s digital economy. Authorities, companies, and users all have roles to play in reducing Nigeria’s exposure to data compromise and digital exploitation.
