A recent report by Paradigm Initiative reveals that several unauthorised websites are selling sensitive personal and financial data of Nigerians for as little as N100.
Paradigm Initiative, in a statement on Thursday, said this alarming development presents a major breach of fundamental rights to privacy, a breach of data privacy rights, and poses significant risks to individuals and the national economy.
It stated that following an investigation conducted, it was found that AnyVerify.com.ng, a website operating since November 2023, is commercialising personal data, including National Identity Numbers, Bank Verification Numbers, driver’s licences, and phone numbers, for N100 per request to any interested party.
The website reportedly had over 567,990 visits in February 2024 and 188,360 in April 2024.
The report read in part, “On the 16th of March, 2024, an online media outlet, Fij.ng, published a story on its platform, with the headline, ‘ALERT: XpressVerify, a Private Website, Has Access to Registered Nigerians’ Data and Is Making Money From It.’ In that publication, the media outlet presented an investigative story of a website with the web address, www.XpressVerify.com.ng, that had access to the personal data of Nigerian citizens and commercialised the data for personal gain. Even though the website was quickly taken down, Paradigm Initiative is currently seeking legal redress on behalf of Nigerian citizens.
“Following the XpressVerify incident, further research was undertaken and it was discovered that another actor tagged AnyVerify.com.ng has been operating in the digital space of Nigeria since November 2023.
“From our research, AnyVerify.com.ng is a website involved in the commercial distribution of personal and private data of Nigerians. On its webpage, a drop-down displaying the myriad of data services which the website renders can be observed. These include personal data such as the National Identity Number (NIN), the Bank Verification Number (BVN), a virtual NIN, Driving License, International Passport, Company details, Tax Identification Number (TIN), Permanent Voter’s Card (PVC) and Phone Numbers. All these are sold by this website to any interested party for the sum of N100.00 (One Hundred Naira Only) for each data request. This website was visited five hundred and sixty-seven thousand, nine hundred and ninety (567,990) times in February 2024 and one hundred and eighty-eight thousand, three hundred and sixty (188,360) times in April 2024.”
It added that due to the severe implications for millions of Nigerians, Vindich Legal, through its legal partners, has served a pre-action notice to relevant government agencies.
The agencies include the National Identity Management Commission (NIMC), the Nigeria Data Protection Commission (NDPC), the Nigeria Immigration Service (NIS), the Federal Inland Revenue Service (FIRS), the Central Bank of Nigeria (CBN), the Independent National Electoral Commission (INEC), the Federal Road Safety Corps (FRSC), and the Office of the Attorney General of the Federation (AGF).
Speaking on the implications of these data leaks, Paradigm Initiative noted that unauthorised access to personal data is a blatant infringement on the privacy of Nigerian citizens.
It added that the dissemination of such information could lead to identity theft, financial fraud, and other malicious activities, including data owners being targeted by burglars, kidnappers, or terrorists who buy data that includes home addresses.
According to the Paradigm Initiative, the availability of sensitive financial data online can undermine the stability of Nigeria’s banking system, adding that fraudulent transactions and identity theft can erode public trust in financial institutions, potentially leading to a financial crisis.
It added that this is exacerbated by recent findings of huge losses suffered by financial institutions in Nigeria due to digital manipulation.
Paradigm Initiative, however, called on the Nigerian government to take immediate and decisive action to address this critical issue.
This includes conducting a thorough investigation to identify these illegal online activities, enhancing cybersecurity measures to prevent further data breaches, implementing Nigeria’s Data Protection Act, strengthening the Nigeria Data Protection Commission (NDPC), and guaranteeing the independence of the NDPC to ensure the privacy and security of citizens’ information.
THEGUARDIAN
