Panic has spread among customers of Sterling Bank following reports of a major data breach that may have exposed sensitive personal and financial information, prompting a federal investigation into the incident.
The controversy centers on claims by a dark web actor identified as “ByteToBreach,” who alleges responsibility for infiltrating the bank’s systems and accessing a large volume of customer and employee data.
According to findings by ENigeria Newspaper, the suspected breach may have compromised data linked to nearly one million customer accounts, alongside over 3,000 employee records, including information tied to senior executives.
The reportedly exposed data includes Bank Verification Numbers (BVN), NUBAN account details, identification documents such as passports and driver’s licences, transaction histories, loan records, credit scores, and internal staff information.
For many customers, the development has triggered serious security concerns, especially amid rising cases of fraud and kidnapping in the country. Some account holders are said to be considering closing their accounts over fears that their data could be exploited by criminal networks.
“This is no longer just about banking services, it is about personal safety,” a concerned customer reportedly said in Lagos.
Preliminary reports suggest the breach may have stemmed from a vulnerability in Oracle WebLogic Server, a middleware system used to connect applications to backend databases. Attackers are believed to have bypassed authentication layers and extracted about 2.2GB of sensitive data, including personally identifiable information of more than 900,000 customers.
Cybersecurity analysts warn that such data could be used for sophisticated fraud schemes, including advanced social engineering tactics where criminals impersonate legitimate institutions to obtain one-time passwords and other credentials.
The incident has also raised questions about the bank’s cybersecurity readiness under the leadership of CEO Abubakar Suleiman, with some industry observers suggesting that greater investment in digital security infrastructure may have been needed.
In response to the situation, the Nigeria Data Protection Commission has launched a formal investigation, extending its probe to include Remita Payment Services Ltd., a key player in the country’s digital payments ecosystem.
The Commission confirmed that a Notice of Investigation was issued on April 1, 2026, and that relevant parties are currently being questioned. The National Commissioner, Vincent Olatunji, has directed a comprehensive inquiry, warning that any organisation found to have violated the Nigeria Data Protection Act (2023) will face strict sanctions.
Beyond regulatory scrutiny, the alleged breach poses a significant reputational risk for Sterling Bank, as customer trust remains central to the banking sector. Analysts note that even the perception of weak data protection could have lasting consequences.
The development has also reignited concerns about cybersecurity preparedness across Nigeria’s financial system, particularly as digital banking continues to expand.
While investigations are ongoing, the incident has underscored the growing importance of data security in the digital age, raising urgent questions about how well financial institutions are safeguarding sensitive customer information.
🚨BREAKING: Watch The Video Clip Here ➤
