Nigeria recorded over 119,000 leaked data breaches in the first quarter of 2025, according to the latest global data breach report from cybersecurity firm Surfshark.
This places the country 34th worldwide in terms of the number of breached accounts.
A data breach means that an intruder copied and leaked user data such as names, surnames, email addresses, passwords, etc.
One breached email address is considered as one breached user/account.
However, while the figure for Nigeria may appear alarming, it actually reflects a sharp decline in breach activity compared to previous quarters.
Surfshark’s analysis indicates an 85% drop in the number of leaked accounts in Nigeria from Q4 2024 to Q1 2025, in line with a global trend that saw leaked accounts plunge 93% year-on-year, from 973.7 million in Q1 2024 to just 68.3 million in Q1 2025.
Surfshark’s long-term data shows that Nigeria remains one of the most affected countries in Sub-Saharan Africa when it comes to data breaches.
Since 2004, approximately 23.2 million Nigerian user accounts have been compromised.
Out of these:
Globally, the most affected countries were the United States (16.9 million leaked accounts), followed by Russia (4.4 million), India (4.2 million), Germany (3.9 million), and Spain (2.4 million).
Despite the drop in Nigeria and a few other countries captured in the report, cybersecurity experts are warning against complacency.
“Although the number of vulnerable accounts in all major regions decreased, people should remain vigilant,” said Research Lead at Surfshark, Luís Costa.
“Cyberthreats are constantly evolving, and attackers are adapting their tactics. Strong security practices, frequent password updates, and enabling two-factor authentication remain essential,” he added.
Countries with the highest breach density (measured by the number of leaked accounts per 1,000 residents) were:
Surfshark’s research is based on data gathered from 29,000 publicly available databases.
Each unique breached email address is treated as a separate user account, and breaches often include additional personal data such as passwords, phone numbers, IP addresses, and postal codes.
Each unique breached email address is treated as a separate user account, and breaches often include additional personal data such as passwords, phone numbers, IP addresses, and postal codes.
The data was anonymized before analysis, and countries with populations under one million were excluded from the study.