Data breach: NIN, BVN of Nigerians sold online for just 100 naira- Paradigm Initiative

In what appears to be a major data breach involving personal and sensitive details of millions of Nigerians collected during various government exercises, a digital rights organization, Paradigm Initiative has revealed that personal details of Nigerians are readily available on online platforms for just 100 naira.

This was revealed in a press statement seen by Technext.

The statement precisely implicated a platform, AnyVerify.com.ng which has been operating in the digital space of Nigeria since November 2023. This website was visited five hundred and sixty-seven thousand, nine hundred and ninety (567,990) times in February 2024 and one hundred and eighty-eight thousand, three hundred and sixty (188,360) times in April 2024.

“In a shocking revelation, Paradigm Initiative has found out that several unauthorised websites are claiming to hold and provide access to sensitive personal and financial data of Nigerian citizens for as little as 100 Naira. This alarming development presents a major breach of the fundamental rights to privacy, a breach of data privacy rights and poses significant risks to individuals and the national economy,” the statement reads.

This is coming just months after online media outlet, Fij.ng, published a story on its platform, alerting the public and the government that an unauthorized private website, www.XpressVerify.com.ng, has access to registered Nigerians’ data and is making money off it. Following the publication of that investigative story, the website was quickly taken down.

Now, it seems another platform has since taken its place, raising concerns that there may be many more.

The digital rights platform said it carried out further research into this latest data breach in which it discovered that AnyVerify.com.ng is a website involved in the commercial distribution of personal and private data of Nigerians.

“On its webpage, a drop-down displaying the myriads of data services which the website renders can be observed. These include personal data such as the National Identity Number (NIN), Bank Verification Number (BVN), virtual NIN, Driving License, International Passport, Company details, Tax Identification Number (TIN), Permanent Voter’s Card (PVC) and Phone Numbers. All these are sold by this website to any interested party for the sum of N100.00 (One Hundred Naira Only) for each data request,” the statement said.

This reporter visited the said website which belongs to AnyVerify, an entity that claims to carry out “the most reliable verification services at the cheapest prices.” The company’s address is at Zoo Road in Kano, however, while it provided a contact email, it produced half of a mobile phone number.

Details on the platform were also written in very bad English.

The reporter also contacted the Executive Director of Paradigm Initiative, Gbenga Sesan who clarified that the organisation is not claiming that AnyVerify is unauthorised since only the National Identity Management Commission (NIMC) can confirm or deny such.

“However, AnyVerify’s practice of selling NIN slips of others for N100 is illegal and violates Nigeria’s Data Protection law. It is the responsibility of any verification company to put guards in place to avoid abuse, but AnyVerify refused to do that and NIMC has failed to sanction them,” he said.

He also expressed his suspicion that there are many such platforms out there, including those who may buy such data to resell on the secondary market, a situation he attributed to the irresponsibility of the NIMC.

“This is a situation of an irresponsible NIMC giving access, through APIs and other channels, to the data in their custody without ensuring oversight. This also rests on the Nigeria Data Protection Commission (NDPC) because when the case of XpressVerify was reported, they simply slapped NIMC on the wrist,” he said.

Data breach could lead to privacy violations

Paradigm Initiative pointed out that the activities of AnyVerify are tantamount to privacy violations as the unauthorised access to personal data is a blatant infringement on the privacy of Nigerian citizens.

They also said the dissemination of such information could lead to identity theft, financial fraud, and other malicious activities, including data owners being targeted by burglars, kidnappers or terrorists who buy data that includes home addresses.

They also noted that the availability of sensitive financial data online can undermine the stability of Nigeria’s banking system and erode public trust through fraudulent transactions and identity theft. They also said the breach of driver’s licence information and other personal data can compromise national security. Such information can be exploited by criminal elements for unlawful activities, posing a threat to the safety and security of the nation.

It is therefore urging the federal government to conduct a thorough investigation to identify these illegal online activities while enhancing cybersecurity measures to prevent further data breaches.

It also tasked the government to implement Nigeria’s Data Protection Act, and compel all involved agencies of government to release official information to the public regarding the activities of their agents and sub-licensees.

See also: NIMC temporarily suspends third-party agents from NIN enrollment ahead of CBN deadline