Zenith Bank confirms data breach exposing customer contact details (2026)

On 4 August 2026, Zenith Bank — one of Nigeria's largest commercial lenders — confirmed that an unauthorised third party had breached its systems and accessed a limited set of customer information. In a notice to customers, the bank said the exposed data was confined to contact details such as email addresses and phone numbers, and stressed that no sensitive banking information had been compromised.

What happened

Zenith Bank described the intrusion as part of a broader wave of cyberattacks striking institutions across multiple industries. The bank said its core banking systems, digital channels, and customer funds remained secure and fully operational, and that it had activated its incident-response procedures on detecting the breach. It did not attribute the attack to any named threat actor, and its investigation into the scope of the incident is ongoing.

Why it matters

Although the exposed fields were limited, contact details alone are enough to fuel targeted phishing and social-engineering campaigns against banking customers. Zenith urged customers to be vigilant against unsolicited emails, text messages, and phone calls, and reminded them never to share passwords, PINs, or one-time passcodes.

The disclosure came amid intensifying cyber pressure on Nigeria's financial sector. Earlier in 2026, several other Nigerian institutions — including Sterling Bank and Providus Bank — had reported unauthorised access to customer data, underscoring how attackers increasingly view the country's fast-digitising banking industry as a high-value target.