A political aide to FCT Minister Nyesom Wike published restricted data from INEC’s backend portal to mock an actor running for office. INEC confirmed the breach. The data regulator has said nothing.
By Epiphanus Obia
On the morning of 30 May 2026, Lere Olayinka, media aide to Federal Capital Territory Minister Nyesom Wike, posted two screenshots on X. They showed the voter registration details of Nollywood actor Emeka Ike, his face, his Voter Identification Number, his application number, his fingerprint upload status, his registration centre, and the precise timestamps of when his transfer application was created and last updated.
The point Olayinka was making was political. Ike had announced plans to contest a House of Representatives seat in the FCT under the Nigeria Democratic Congress, and had recently protested alleged irregularities in the party’s primaries. Olayinka wanted to question his eligibility. “Emeka Ike was a registered voter in Imo State,” he wrote. “He only transferred his INEC Registration to the FCT on May 15, 2026 (15 days ago). And he wants to contest for House of Reps in Abuja! Someone who has never voted in the FCT o.”
The screenshots told a different story to anyone paying attention to the browser address bar. The URL visible in both images read: cvradmin.inecnigeria.org/applications_manager/viewApplication/cb8e808. That is not INEC’s public-facing voter lookup portal. It is an administrative backend, the Continuous Voter Registration system used exclusively by authorised INEC registration officers to process applications, approve transfers, and update records. Ordinary Nigerians do not have access to it, but Lere Olayinka did and he does not even work for INEC.
What INEC’s own statement confirmed
The backlash was immediate. Cybersecurity analysts, legal commentators, journalists, and ordinary Nigerians called for an explanation, from Olayinka and from INEC. The electoral commission was initially silent. But on 2 June, it published a formal press statement on X.
The statement confirmed that the information came from its CVR database. It confirmed there was no external hack. What it said instead was this: the data was accessed through “valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority.” An audit trail had identified the user account and the relevant staff had been questioned.
In plain language: an INEC staff member, using their own legitimate login, pulled Emeka Ike’s voter record and passed it to Wike’s aide. INEC did not name the staff member, and it did not name Lere Olayinka anywhere in its statement.
That omission did not go unnoticed. Several Nigerians pointed out that a press statement responding to a controversy triggered by a named individual, about a named piece of content published on a named social media account, managed to avoid mentioning that person once.
A pattern, not an incident
This was not Olayinka’s first time. In August 2025, the Foundation for Investigative Journalism reported that he had published the tax clearance certificate of former senator Dino Melaye, including Melaye’s Tax Identification Number, residential address, and other personal details. The FCT Internal Revenue Service told FIJ at the time that tax certificates were private documents that could not lawfully be disclosed without the taxpayer’s consent, and expressed difficulty understanding how anyone other than the taxpayer or an authorised representative could obtain one. Nothing happened after that.
Emeka Ike’s voter record is the second sensitive government document that Olayinka has posted on X for political effect. The first involved tax records. This one involves a restricted electoral database that holds biometric information for over 90 million registered voters.
What the law says
Legal commentator Ekene Aninze raised the core question that INEC’s statement failed to answer: why does a frontline registration officer have access privileges broad enough to retrieve and export the individual record of a specific candidate, apparently without any technical barrier, flag, or alert triggering?
“Why does INEC’s server lack tools capable of blocking, tracking, or flagging unauthorised digital exports of confidential voter information?” Aninze asked on X.
The question goes to architecture, not just conduct. INEC says no external breach occurred. But the fact that an internal staff member could pull a specific record, photograph the screen, send it possibly via WhatsApp, and have it appear on a politician’s public social media feed (with nothing in the system stopping or detecting it until after the damage was done) is a governance failure, not just a disciplinary one.
Under the Cybercrimes Act (as amended), a person who intentionally commits an offence against a critical national information infrastructure faces up to ten years in prison. Section 6 criminalises unlawful access to computer systems and prescribes up to two years’ imprisonment, a ₦5 million fine, or both, rising to five years where access is obtained fraudulently. Section 27(1) extends the same liability to anyone who “aids, abets, conspires, counsels or procures” such an offence.
The police have questioned Olayinka and detained an INEC electoral officer suspected of providing the data. The Department of State Services is also investigating. As of the time of publication, no charges have been filed.
Where is the NDPC?
The incident is precisely the kind of data breach that the Nigeria Data Protection Commission exists to investigate. The NDPA 2023 imposes obligations on data controllers to protect personal data from unauthorised access, loss, or misuse. INEC, which manages biometric records for over 90 million registered voters, is one of the largest data controllers in the country, and one that an earlier ITPulse News audit found has no privacy policy of its own.
That audit, published in May 2026, assessed INEC and 21 registered political parties against the NDPA 2023 and the NDPC’s General Application and Implementation Directive 2025 across 31 criteria. INEC scored 16.1 per cent — the second lowest of all 22 subjects audited. The commission’s own Resources section links to the Data Protection Bill 2020, confirming it knows the law exists. It simply does not comply with it.
The NDPC has made no public statement on the Lere Olayinka incident, and it has not announced an investigation. It has not also issued guidance to the public about their rights as voters whose data has now demonstrably been accessed and shared without their consent.
This is not a minor gap. An independent data regulator that stays silent when a named individual’s voter ID number, face, and fingerprint record are posted on social media by a political operative, sourced from a restricted government database, is not functioning as a regulator.
A question about 2027
Veteran broadcaster Rufai Oseni put the stakes plainly: “How can just a political aide have access to Emeka Ike’s data? If a political aide can access such information, then imagine what politicians themselves can access. As far as I’m concerned, the 2027 election is already tainted.”
Journalist Reuben Abati made a similar point, calling on Olayinka to explain publicly how he obtained access to a portal reserved for INEC’s ICT department.
The concern is not just about one actor’s voter transfer record. It is about what else is accessible, to whom, and whether any of it would show up if INEC’s audit trail had not been prompted by a very public post on X. If the only thing that triggered an internal investigation was the fact that a screenshot went viral, the question follows: how many quiet accesses happened before this one, and how many will happen after it?
INEC’s statement said the incident “does not indicate any compromise of the Commission’s broader voter registration infrastructure or the personal data of over 90 million registered voters.”
That may be true. But it is also exactly what an institution under pressure would say. The difference between a targeted one-off and a systemic problem is not something INEC can credibly determine about itself through an internal audit. It requires an independent forensic examination, which neither INEC, the police, nor the NDPC has committed to conducting.
Olayinka has also neither deleted the original post nor apologised publicly for making the post.