A notorious threat actor has claimed responsibility for a data breach at Sterling Bank Plc, alleging the exposure of a large volume of customer and employee data.
Last week, the threat actor known as ByteToBreach published what it claims are more than 9 million records on DarkForum, an English-language dark web platform known for the exchange of stolen databases, hacking tools, and malware.
According to the actor, the breach involves data linked to approximately 900,000 customer accounts and more than 3,000 employee records. The actor also claimed the existence of a separate dataset connected to Cardinal Stone, an investment banking and multi-asset management firm.
The leak, according to the threat actor, is said to contain personally identifiable information (PII), raising concerns about risks such as identity theft, financial fraud, and unauthorised access to sensitive records.
The threat actor also stated that the hacked systems were located within Sterling Bank Plc’s internal network architecture, as defined by its autonomous system number (ASN). If confirmed, this could point to a direct penetration of the bank’s internal environment rather than a third-party compromise.
The actor also claimed that access gained through the breach was used to target external systems, including Remita, a popular payment platform.
The threat actor further claimed that approximately 3 terabytes of data were accessed from cloud storage, including over 800 gigabytes linked to Know Your Customer (KYC) services. The data is said to include identity documents such as passports, photographs, bank statements, and utility bills, alongside MySQL and PostgreSQL databases, logs, and container registries.
Another document released by the actor suggests that initial access within Sterling Bank Plc may have been used to pivot into external systems, including CRC Credit Bureau, one of the largest credit reporting agencies in Nigeria and Africa.
None of the organisations mentioned, Sterling Bank Plc, CRC Credit Bureau, Cardinal Stone and Remita, have publicly confirmed the alleged breach. When contacted on April 2, 2026, Sterling Bank Plc declined to comment.
Who Is ByteToBreach and Why Should You Take This Seriously?
ByteToBreach is not a first-time offender or a low-level hacker attempting to build a reputation. Intelligence researchers at KELA Cyber, a leading global threat intelligence firm, have tracked this actor since at least June 2025, documenting a sophisticated, cross-platform criminal operation that spans multiple continents and industries.
The actor’s confirmed or corroborated prior targets include:
Uzbekistan Airways: leaked passenger data that included records of U.S. government employees
Seychelles Commercial Bank: exfiltrated customer banking data and attempted extortion
Viking Line (March 2026): confirmed traveler data exposure including payment transaction records
Organizations in Ukraine, Kazakhstan, Cyprus, Poland, Chile, and the United States
His method is not random. He exploits weaknesses in cloud infrastructure, uses stolen login credentials harvested from malware-infected devices, and conducts large-scale data theft for sale on criminal marketplaces. Several of his past claims have been independently verified. This is a credible actor, and his expansion into sub-Saharan African banking should concern every financial institution on the continent.
What Data Was Allegedly Stolen and Why It Is So Dangerous
Not all data breaches are equal. What makes the Sterling Bank Nigeria data breach claim particularly severe is the combination of data types allegedly stolen. Together, they form a complete financial identity package for each affected customer.
BVN (Bank Verification Number): This is the 11-digit biometric number that links a Nigerian to every bank account they hold across the entire banking system. Exposing a BVN enables criminals to commit fraud across multiple banks at once.
NUBAN (Nigeria Uniform Bank Account Number): The standard account number used for all transactions. Combined with BVN data, this allows near-complete account takeover.
Transaction histories and loan records: Knowing what a person earns, spends, and owes enables highly targeted scams and social engineering attacks tailored to individual financial circumstances.
Passport and driver’s license copies: Physical identity documents create the foundation for new fraudulent accounts, SIM swap attacks, and government identity exploitation.
Employee records (3,000+ staff): Internal staff data exposes the bank to insider fraud, targeted phishing of employees, and supply chain attacks against the institution itself.
In practical terms, a fraudster armed with this data could call a Sterling Bank customer, recite their exact loan balance and last three transactions, and convincingly demand an OTP code. That is not a hypothetical scenario. It is the documented playbook of Nigerian financial cybercrime.
Nigeria’s Regulatory Response: Strong Laws, but the Clock Is Ticking
Nigeria has substantially strengthened its data protection and cybersecurity legal framework in recent years. If this breach is confirmed, Sterling Bank faces overlapping regulatory obligations and potential enforcement action on multiple fronts:
Nigeria Data Protection Act 2023 (NDPA): Requires prompt notification to affected data subjects and the Nigeria Data Protection Commission (NDPC). The NDPC has already levied fines exceeding 766 million naira against other organizations for data violations.
Amended Cybercrimes Act 2024: Introduces a mandatory 72-hour incident reporting requirement for critical digital infrastructure, which directly applies to licensed deposit money banks.
CBN Risk-Based Cybersecurity Framework (2024): Mandates incident response readiness and breach reporting to the Central Bank of Nigeria.
The regulatory environment is no longer one of warnings and grace periods. Nigeria is in an active era of enforcement. A bank breach affecting 900,000 customers, if confirmed, would represent the most significant financial sector data exposure in recent Nigerian history and would demand a visible, urgent institutional response.
What Should You Do Right Now?
Whether you are a Sterling Bank customer, a security professional, or a policymaker, the response to this threat should be immediate:
For Sterling Bank customers: Monitor your account daily for unauthorized transactions. Be deeply suspicious of any call, SMS, or email that references your loan balance, account number, or personal details. Never share an OTP code under any circumstances.
For security professionals: Treat Nigerian banking sector BVN and NUBAN data as a high-value active threat in your threat intelligence feeds. Flag any dark web listings referencing Sterling Bank data for immediate escalation.
For financial institutions and policymakers: This incident, verified or not, signals that Nigeria’s banking sector has entered the crosshairs of sophisticated international threat actors. Minimum cybersecurity spending thresholds and mandatory penetration testing cycles must be accelerated.
For Sterling Bank itself: Issue a public statement immediately. Silence in the face of a credible, publicly circulating breach claim is itself a communications failure that erodes customer trust.
The Sterling Bank Nigeria data breach claim is not yet confirmed. But the threat actor behind it has a documented track record of real, verified attacks on banks, airlines, and governments across four continents. Nigeria’s financial sector, in the middle of a historic recapitalization and digital transformation drive, cannot afford to treat this as background noise.
The BVN is the cornerstone of Nigeria’s banking identity infrastructure. If 900,000 of them have been compromised alongside complete financial profiles, the downstream consequences for fraud, identity theft, and public trust in the digital financial system would be severe and long-lasting.
🚨BREAKING: Watch The Video Clip Here ➤
