Nigeria NIN national-ID data exposure

Beginning in late 2023 and erupting publicly in March 2024, a cluster of unauthorized "verification" websites was caught selling the personal data of millions of Nigerians — drawn from the National Identity Management Commission (NIMC) identity database — for as little as ₦100 (about $0.07) per record.

What happened

Sites including XpressVerify.com and AnyVerify.com.ng offered instant lookups of citizens' National Identification Numbers (NIN), Bank Verification Numbers (BVN), virtual NINs, driver's licences, passports, tax IDs, voter cards, and phone numbers. A Foundation for Investigative Journalism (FIJ) report on 16 March 2024 demonstrated that XpressVerify could return a complete NIN profile for a trivial fee; the site was taken offline shortly afterward.

The scale was substantial: AnyVerify alone recorded an estimated 567,990 visits in February 2024. Crucially, security experts and the regulator concluded this was not a direct hack of NIMC's database. Instead, the sites exploited improperly governed access — likely API connections granted to licensed verification agents and then resold or abused outside regulatory rules. As one stakeholder put it, "they haven't hacked into the database; instead, they have leveraged some form of access that is not in line with regulations."

Response

NIMC publicly denied that its database was compromised, citing ISO 27001:2013 certification and compliance with the Nigeria Data Protection Act 2023, and on 25 June 2024 flagged five offending websites: idfinder.com.ng, verify.ng, championtech.com.ng, trustyonline.com, and anyverify.com. The Nigeria Data Protection Commission (NDPC) opened an investigation into the unauthorized processing and monetisation of citizens' data. Civil-society group Paradigm Initiative served pre-action legal notices on eight federal bodies — including NIMC, NDPC, the immigration service, the tax authority, the central bank, and INEC — demanding investigation, compensation, and stronger enforcement.

Impact

Because NIN and BVN underpin banking, SIM registration, and access to government services in Nigeria, the cheap availability of these identifiers created broad exposure to SIM-swap fraud, account takeover, and identity theft. The episode also intensified concern over the security of centralised national-ID systems, where a single layer of resold access can effectively leak an entire population's identity data without the core database ever being breached.

Why it matters

The NIMC case is a textbook example of third-party and API-governance failure rather than a classic intrusion. It demonstrated that a national identity system is only as secure as the ecosystem of agents and integrators authorised to query it, and it became a defining test of Nigeria's then-young Data Protection Act 2023 and the NDPC's willingness to enforce it.