Nigeria has recorded about 24.1 million compromised user accounts since 2004, making it the third most affected country in Sub-Saharan Africa, according to a new report by cybersecurity firm, Surfshark.
The report, which analysed global data breach trends for the first quarter of 2026, showed that Nigeria recorded 281,500 leaked accounts between January and March 2026, ranking the country as the 34th most breached nation globally during the period.
Globally, the report revealed that 210.3 million accounts were breached in the first quarter of 2026, representing a sharp increase compared to previous periods.
The United States accounted for 29 per cent of all reported breaches worldwide, followed by France, India, Brazil and the United Kingdom.
According to the report, cyber threats targeting Nigerian users have continued to intensify over the years, exposing millions of individuals to risks such as identity theft, account hijacking, extortion and financial fraud.
Surfshark disclosed that about 7.5 million unique email addresses linked to Nigerian users have been exposed since 2004, while approximately 13 million passwords were leaked alongside compromised accounts.
The report noted that more than half of breached Nigerian users remain vulnerable to cyber-related crimes.
“Statistically, 10 out of 100 Nigerian people have been affected by data breaches,” the report stated.
Further analysis showed that leaked data linked to Nigerian users included highly sensitive information such as Social Security-related records, payment card details, residential addresses, and personal contact information.
According to the report, about 3,900 Social Security-related records and 1,600 payment card details were exposed, alongside 1.9 million phone numbers and more than 925,000 residential addresses.
The cybersecurity firm warned that the growing scale of data exposure reflects increasing vulnerabilities in the global digital ecosystem as businesses accelerate the adoption of artificial intelligence technologies.
Commenting on the trend, Surfshark’s Chief Security Officer, Tomas Stamulis, said the rapid integration of AI systems by companies has significantly expanded the volume of user data being collected and stored.
According to him, businesses are increasingly relying on AI-driven tools for automation, analytics and operational efficiency, leading to the accumulation of larger datasets that could become attractive targets for cybercriminals.
The report cited industry statistics indicating that 20.2 per cent of companies used AI technologies in 2025, up from 8.7 per cent in 2023.
“These AI-driven systems collect and log more detailed user information for automation, analytics, and model improvement,” Stamulis said.
He added that while artificial intelligence improves productivity and operational efficiency, it also increases the number of systems organisations must secure, thereby creating additional opportunities for cyberattacks and data leaks.
Stamulis further warned that compromised personal information often retains value for cybercriminals long after passwords or email credentials have been changed.
According to him, hackers frequently combine old and newly leaked information into so-called “combo lists,” which are repeatedly traded or deployed for fraudulent activities and identity theft schemes.
He advised internet users to minimise the amount of sensitive personal information shared online, use alternative email identities or masking services where possible, and provide confidential information only when necessary.
The report also showed that global breached accounts in the first quarter of 2026 tripled compared to the corresponding period of 2025 and rose by 22 per cent relative to the fourth quarter of 2025, underscoring the growing sophistication and frequency of cyberattacks worldwide.
