The Borno State Government has been found to have published sensitive personal and financial details of more than 1,300 civil servants in a publicly accessible online document, raising fresh concerns about data privacy violations in Nigeria.
A review of state-owned digital assets revealed that a 27-page file titled “Gratuity Arrears Balance as at 31st December 2020” was uploaded in January 2022. The document contained the Bank Verification Numbers (BVNs), bank account numbers, names, and staff IDs of 1,389 civil servants. Metadata showed it was created on January 12, 2022, by a user or system identified as “AEC-MEDIA,” with the content originally derived from an Excel spreadsheet dating back to 2021.
Even though the BVN alone cannot move money from bank accounts, but combined with account numbers and personal details, and civil servants are suddenly vulnerable to fraud. Fraudsters can impersonate them, lure them into phishing scams, use their details to collect loans, or worse.
And with Nigeria’s already porous databases, leaking a BVN opens the door to even bigger breaches: addresses, dates of birth, even images of the BVN holder.
The file, which remained accessible online, was intended to provide details of gratuity arrears owed to civil servants but inadvertently disclosed confidential financial identifiers. Such exposure leaves affected individuals vulnerable to fraud, impersonation, phishing, and other forms of identity theft.
This development adds to a growing list of breaches uncovered in recent months across Nigerian government websites. Since July, several ministries, departments, and agencies (MDAs) have been found to have either deliberately or inadvertently exposed personal data, in clear violation of national data protection laws.
The Central Bank of Nigeria (CBN) has classified BVN data as sensitive information. Its 2017 Regulatory Framework for BVN Operations states that “the BVN and any information linked to it shall be confidential and shall not be divulged to any third party, except as required by law.” The framework also prescribes sanctions for misuse or unauthorised disclosure of BVN information.
Beyond the CBN’s regulation, Section 37 of the 1999 Constitution (as amended) guarantees the privacy of citizens. The Nigeria Data Protection Act (NDPA) 2023 further strengthens these rights, holding data controllers liable for violations. Under the Act, large organisations may face penalties of up to 2% of their annual gross revenue or ₦10 million, whichever is greater.
The potential consequences of such breaches are already evident in Nigerian courts. In June 2024, businessman Nzubechi Okoro sued Ecobank after his BVN was used without consent to secure a loan under the Anchor Borrowers’ Scheme. His BVN was subsequently blacklisted by the CBN, restricting his access to banking services. The Ebonyi State High Court awarded him ₦10 million in damages for financial loss and reputational harm.
In another case, Chinedu Nwoke filed a suit against United Bank for Africa (UBA) and NIRSAL Microfinance Bank after a ₦700,000 loan was fraudulently taken in his name using his BVN. His accounts were blacklisted, and the case remains in court.
Data protection experts warn that even when a BVN alone cannot directly move funds, combining it with bank account numbers, phone numbers, or national identity details significantly heightens the risk of fraud. Investigations have shown that such data is already traded on black-market platforms, where identification slips containing names, photos, addresses, and phone numbers can be purchased cheaply.
Despite the legal framework and visible risks, there appears to be little enforcement or accountability when breaches occur on government platforms. The exposure of Borno State civil servants’ details highlights systemic weaknesses in Nigeria’s data governance and poses significant threats to citizens’ financial and personal security.
Credit: Foundation for Investigative Journalism (FIJ)