In a shocking revelation, Paradigm Initiative, an organisation that connects underserved young Africans with digital opportunities and ensures the protection of their rights, has found that several unauthorised websites claim to hold and provide access to sensitive personal and financial data of Nigerian citizens for as little as N100.
The alarming development represents a significant breach of fundamental privacy rights and poses substantial risks to individuals and the national economy.
On March 16, an online media outlet published a story titled, ‘ALERT: XpressVerify, a Private Website, Has Access to Registered Nigerians’ Data and is Making Money From it.’
The publication presented an investigative story about www.XpressVerify.com.ng, a website that had access to Nigerian citizens’ personal data and was commercialising it for personal gain.
Although the website was quickly taken down, Paradigm Initiative is currently seeking legal redress on behalf of Nigerian citizens.
Following the XpressVerify incident, further research revealed that another website, AnyVerify.com.ng, has been operating in Nigeria’s digital space since November 2023.
According to Paradigm Initiative, AnyVerify.com.ng is involved in the commercial distribution of personal and private data of Nigerians.
The website offers various data services, including access to the National Identity Number (NIN), Bank Verification Number (BVN), virtual NIN, driving licence, international passport, company details, Tax Identification Number (TIN), Permanent Voter’s Card (PVC) and phone numbers. Each data request costs just N100.
The website was visited 567,990 times in February 2024 and 188,360 times in April 2024.
Due to the severe implications for millions of Nigerians, Paradigm Initiative, through its legal partners, Vindich Legal, said it has served a pre-action notice to several government agencies, including the National Identity Management Commission (NIMC), Nigeria Data Protection Commission (NDPC), Nigeria Immigration Service (NIS), Federal Inland Revenue Service (FIRS), Central Bank of Nigeria (CBN), Independent National Electoral Commission (INEC), Federal Road Safety Corps (FRSC) and the office of the Attorney General of the Federation (AGF).
The unauthorised access to personal data is an infringement on the privacy of Nigerian citizens. The dissemination of such information could lead to identity theft, financial fraud and other malicious activities, including data owners being targeted by burglars, kidnappers, or terrorists who purchase data that includes home addresses.
The availability of sensitive financial data online can undermine the stability of Nigeria’s banking system. Fraudulent transactions and identity theft can erode public trust in financial institutions, potentially leading to a financial crisis.
This issue is exacerbated by recent findings of significant losses suffered by financial institutions in Nigeria due to digital manipulation.
The breach of driver’s license information and other personal data can compromise national security. Such information can be exploited by criminal elements for unlawful activities, posing a threat to the safety and security of the nation.
The existence of these websites, according to Paradigm Initiative, highlights significant gaps in data protection and cybersecurity measures within the country. It underscores the urgent need for robust data protection laws and stringent enforcement mechanisms to safeguard citizens’ data.
It said the Nigerian government is urged to take immediate and decisive action to address this critical issue. This includes conducting a thorough investigation to identify these illegal online activities, enhancing cybersecurity measures to prevent further data breaches, implementing Nigeria’s Data Protection Act, strengthening the Nigeria Data Protection Commission (NDPC), and guaranteeing the independence of the NDPC to ensure the privacy and security of citizens’ information, raising public awareness about the risks associated with data breaches and providing guidance on how individuals can protect themselves.
Meanwhile, Paradigm Initiative is seeking a declaration that the unauthorised access to the data of Nigerian citizens by AnyVerify.com.ng and the commercialisation of this data violates Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (CFRN).
A declaration that, by virtue of Section 30 and Section 39 of the Nigeria Data Protection Act (NDPA) 2023, all involved government agencies have a duty to implement appropriate technical and organisational measures to ensure the security and integrity of citizens’ sensitive personal data.
A court order mandating a full investigation and publication of the investigative report regarding the personal data breach occasioned by the data leak to AnyVerify.com.ng and its customers by the National Identity Management Commission (NIMC).
A court order directing all involved government agencies to release official information to the public regarding the activities of their agents and sub-licensees.
A court order directing the involved government agencies to provide restitution in the form of compensation to data subjects affected by the data leak.
“We call upon all stakeholders, including government agencies, financial institutions, the private sector, media institutions, researchers and civil society organisations, to collaborate in addressing this data privacy crisis.
“Protecting the personal information of Nigerian citizens is of paramount importance, and collective efforts are needed to restore trust and ensure the security of our nation’s data infrastructure.
“Nigerians have made significant sacrifices and trusted the government with their personal data in exchange for a social contract that includes security, so it would be ironic to leave all that data in the hands of bad actors such as kidnappers, burglars and terrorists.
“Paradigm Initiative (PIN) has worked in communities across Nigeria since 2007 and across Africa since 2017, building experience, community trust and an organisational culture that positions us as a leading non-profit in ICT for Development and Digital Rights on the continent,” it stated.
Across its regional offices in Cameroon, Kenya, Nigeria, Senegal, Zambia, Zimbabwe, and beyond, the organisation said it has impacted more than 150,000 youth with improved livelihoods through our digital inclusion and digital rights programmes.
ALSO READ: FG engages private sector on Fodder, Soybean export to Saudi Arabia
and then