Customers of Sterling Bank are expressing growing concern following reports of a major data breach that may have exposed highly sensitive personal and financial information.
The situation has drawn the attention of federal authorities, with regulators launching an investigation into the alleged compromise and its potential impact on customers.
The breach is reportedly linked to a dark web figure known as “ByteToBreach,” who claims to have gained unauthorised access to the bank’s systems and extracted a significant volume of data. Findings suggest that records associated with close to one million customers and over 3,000 employees may have been affected, including information tied to senior management.
The data said to be compromised includes Bank Verification Numbers (BVN), NUBAN account details, identification documents, transaction histories, loan information, and internal staff records.
The development has sparked anxiety among customers, many of whom fear the information could be used for fraud, identity theft, or other criminal activities. Some account holders are reportedly considering closing their accounts due to safety concerns.
“This goes beyond banking—it’s about personal security,” a customer said while reacting to the reports in Lagos.
Initial reports indicate that the breach may have occurred through a vulnerability in Oracle WebLogic Server, a key system used to manage communication between applications and databases. The attackers are believed to have bypassed security layers and extracted about 2.2GB of sensitive data, including personally identifiable information of hundreds of thousands of customers.
Cybersecurity experts warn that such data could enable sophisticated scams, particularly advanced social engineering schemes where fraudsters impersonate trusted institutions to obtain confidential details from victims.
The incident has also raised questions about the bank’s cybersecurity framework under the leadership of CEO Abubakar Suleiman, with industry observers stressing the need for stronger investment in data protection systems.
In response, the Nigeria Data Protection Commission has commenced a formal probe into the matter, extending its investigation to Remita Payment Services Ltd. due to its role in Nigeria’s digital payment infrastructure.
The Commission confirmed that it issued a Notice of Investigation on April 1, 2026, and has begun engaging relevant stakeholders. Its Chief Executive, Vincent Olatunji, warned that any organisation found to have breached provisions of the Nigeria Data Protection Act (2023) would face strict penalties.
Beyond regulatory implications, the alleged breach poses a serious reputational challenge for Sterling Bank, as trust remains fundamental to customer relationships in the financial sector.
The incident has also highlighted broader concerns about cybersecurity resilience within Nigeria’s banking industry, particularly as digital financial services continue to expand.
As investigations continue, the case underscores the critical importance of safeguarding customer data in an increasingly digital economy.
READ ALSO:
- Lagos shuts four properties over illegal wastewater discharge
- ACF Warns Nigeria’s Insecurity Has Reached ‘War-Level’, Urges Emergency Response
- Lionel Messi Buys Spanish Club UE Cornellà in First Ownership Move
- Nigerian Couple Jailed in UK for £650,000 Data and Tax Fraud
- Ovie Omo-Agege in the Eye of the Storm
