Nigerian Authorities Probe Alleged Sale of Citizens’ Digital ID Data

Nigeria’s National Identity Management Commission (NIMC) is taking action following revelations of the illicit sale of Nigerian citizens’ personal data by a private company, reassuring citizens and stakeholders about the security of their digital identity information.

Reports from the Foundation for Investigative Journalism (FIJ) uncovered that a company named XpressVerify, positioning itself as an identity verification provider, had unauthorized access to Nigeria’s National Identification Database. This database holds data linked to Nigerians’ National Identity Numbers (NINs), and XpressVerify was found to be selling this information online, constituting what NIMC has termed “an alleged breach of citizens’ data.”

According to FIJ’s initial findings, XpressVerify was selling NINs, full names, phone numbers, addresses, and photographs of individuals for a mere 200 naira (US$0.13) per record.

Neither XpressVerify nor NIMC has provided any indication that the company holds official status as a government partner or service provider.

On Sunday, XpressVerify’s domain registrar, Namecheap Incorporated, announced the suspension of the company’s domain.

Meanwhile, NIMC CEO and DG Engr. Abisoye Coker-Odusote has initiated an investigation into whether any tokenization verification agents have violated their licensing agreements, either directly or through sub-licensees.

The Nigeria Data Protection Commission (NDPC) is also launching its investigation, as reported by The Guardian Nigeria. NIMC has pledged its cooperation with the NDPC’s investigation, with preliminary findings expected within a week.

Last year, Nigeria enacted a new data protection law after years of legislative efforts, and NIMC and NPDC held a workshop on data protection in February to reinforce compliance.

Coker-Odusote recently met with the Senate Committee on National Identity and National Population to outline the challenges NIMC faces in enrolling more Nigerians for their national digital ID.

In contrast to these concerning developments, legitimate Nigerian identity verification provider Youverify announced last week that it had secured $2.5 million in funding.