Nigeria has been ranked as the 34th most breached country globally in the first quarter of 2026, according to the latest quarterly analysis by cybersecurity firm Surfshark. The report reveals that 281,500 Nigerian user accounts were compromised between January and March, contributing to a massive global total of 210.3 million breached accounts.
While the United States remains the primary target, accounting for 29% of all global breaches, followed by France, India, Brazil, and the UK, Nigeria’s long-term statistics paint a sobering picture of the regional landscape.
Since 2004, Nigeria has emerged as the 3rd most affected country in Sub-Saharan Africa, with a cumulative total of 24.1 million compromised accounts. The depth of the crisis is further highlighted by data showing that 10 out of every 100 Nigerians have been affected by a data breach. Additionally, 13 million passwords were leaked alongside Nigerian accounts, leaving 54% of breached users at immediate risk of account takeovers, identity theft, and extortion. Beyond email addresses, the exposed information includes 1.9 million phone numbers, 925,800 physical addresses, 3,900 Social Security Numbers, and 1,600 payment card details.
The global surge in data breaches, which tripled in Q1 2026 compared to Q1 2025 coincides with a massive spike in AI adoption. Surfshark’s Chief Security Officer, Tomas Stamulis, suggests a direct correlation between rapid AI integration and the increase in leaks.
“As companies rapidly adopt AI, they increase the amount of user data stored and expand the number of digital systems they use. AI-driven systems collect more detailed information for analytics and automation. While this improves efficiency, it creates a larger, more complex environment for hackers to exploit. There are simply more points where sensitive information can be exposed,” Stamulis explained.
Stamulis warned that a data leak is not a temporary inconvenience but a permanent threat. Hackers frequently package leaked information into combo lists, reselling them repeatedly on the dark web for decades.
“Even after 10 or 20 years, leaked data remains valuable for committing fraud and stealing money,” he noted. He also voiced concern over businesses that force users to create accounts and provide personal information for simple online purchases where no clear need exists.
In light of these findings, experts recommend a shift in personal data hygiene to combat AI-driven threats by practicing selective disclosure, which involves providing primary contact details and home addresses only for critical official forms. They also suggest utilizing alternative identities or email masking tools for general online activities to protect your primary accounts. Finally, the “need to know” rule should be followed by avoiding the provision of personal data to platforms unless it is strictly necessary for the service being provided.