A significant data breach, potentially compromising the personal and sensitive details of millions of Nigerian citizens, has been brought to light by the digital rights organization, Paradigm Initiative. The organization revealed that critical personal information is readily available on various online platforms for as little as 100 Naira. This alarming discovery was detailed in a press statement recently published by Technext.

The statement specifically implicated AnyVerify.com.ng, a platform that has been active in Nigeria's digital space since November 2023. The website garnered substantial traffic, recording 567,990 visits in February 2024 and 188,360 visits in April 2024. Paradigm Initiative's shocking revelation highlighted that several unauthorized websites are claiming to provide access to sensitive personal and financial data of Nigerians, posing a severe threat to fundamental privacy rights, data privacy laws, and presenting significant risks to individuals and the national economy.

This is not an isolated incident; it follows just months after an investigative report by the online media outlet Fij.ng exposed a similar operation involving www.XpressVerify.com.ng, an unauthorized private website that was also monetizing registered Nigerians' data. While XpressVerify.com.ng was swiftly taken down after the publication, the emergence of AnyVerify.com.ng suggests a recurring pattern, raising concerns about the potential existence of many more such platforms.

Paradigm Initiative conducted further research into AnyVerify.com.ng, confirming its involvement in the commercial distribution of Nigerians' personal and private data. The website's homepage displays a dropdown menu listing a myriad of data services, including highly sensitive information such as the National Identity Number (NIN), Bank Verification Number (BVN), virtual NIN, Driving License details, International Passport information, Company details, Tax Identification Number (TIN), Permanent Voter’s Card (PVC), and Phone Numbers. Each data request is sold to any interested party for a fee of N100.00.

A reporter's visit to AnyVerify.com.ng, which claims to offer “the most reliable verification services at the cheapest prices,” uncovered further concerning details. The company listed an address on Zoo Road in Kano and provided a contact email, but curiously, only half of a mobile phone number. Furthermore, the textual details on the platform were noted to be in very poor English, raising questions about its legitimacy and professionalism.

Gbenga Sesan, Executive Director of Paradigm Initiative, clarified that the organization is not asserting that AnyVerify is unauthorized, as only the National Identity Management Commission (NIMC) has the authority to confirm or deny such. However, Sesan firmly stated that AnyVerify’s practice of selling NIN slips for N100 is illegal and constitutes a direct violation of Nigeria’s Data Protection law. He emphasized that verification companies are obligated to implement safeguards against abuse, which AnyVerify has failed to do, and NIMC has, in turn, failed to sanction them.

Sesan expressed strong suspicions that numerous similar platforms are operating, including those that might acquire such data for resale on secondary markets. He attributed this critical security lapse to the irresponsibility of NIMC, alleging that the commission provides access to data in its custody through APIs and other channels without adequate oversight. He also criticized the Nigeria Data Protection Commission (NDPC), noting that when the XpressVerify case was reported, they merely issued a lenient reprimand to NIMC.

Paradigm Initiative underscored that AnyVerify's activities are tantamount to severe privacy violations, as unauthorized access to personal data directly infringes upon the privacy rights of Nigerian citizens. The dissemination of such sensitive information carries profound risks, including identity theft, financial fraud, and other malicious activities. Data owners could be targeted by criminals such as burglars, kidnappers, or terrorists who exploit leaked home addresses and other personal details.

Moreover, the availability of sensitive financial data online poses a threat to the stability of Nigeria’s banking system and erodes public trust through potential fraudulent transactions and widespread identity theft. The breach of driver’s license information and other personal data also has grave implications for national security, as such information can be exploited by criminal elements for unlawful activities, endangering the safety and security of the nation.

In light of these findings, Paradigm Initiative has urged the federal government to launch a thorough investigation into these illegal online activities. The organization also called for enhanced cybersecurity measures to prevent further data breaches and stressed the importance of fully implementing Nigeria’s Data Protection Act. Furthermore, it tasked the government to compel all involved agencies to publicly release official information regarding the activities of their agents and sub-licensees, a directive that comes after NIMC's temporary suspension of third-party agents from NIN enrollment ahead of a CBN deadline.