Nigeria registered 390,800 leaked user accounts between January and June 2026, translating to an average of one compromised account every minute during the first half of the year.
According to the latest data released by global cybersecurity firm Surfshark, Nigeria ranked as the 38th most breached country worldwide in H1 2026.
Despite the significant number of leaks, the H1 2026 figure reflects a 39.8% decline compared to the second half of 2025 (H2 2025). However, the latest wave of breaches pushes Nigeria’s cumulative total to a staggering 24.3 million compromised user accounts since monitoring began in 2004, making it the 3rd most affected nation in Sub-Saharan Africa.
The analysis reveals that 13 million passwords were leaked alongside Nigerian accounts over the years. This exposes 54% of all breached Nigerian users to severe risks of account takeovers, identity theft, financial fraud, and extortion. Statistically, approximately 10 out of every 100 Nigerians have been impacted by data breaches to date.
Tomas Stamulis, Chief Security Officer at Surfshark, warned that stolen data remains an ongoing threat long after an initial breach occurs:
“Information taken in breaches years ago can remain in circulation for a long time, resurfacing in new fraud schemes and used to target people long after the original incident. The same is true for data being stolen today: even if it is not abused immediately, it can still come back years later in the form of account takeovers, identity abuse, scams, and financial theft.”
Globally, 313.4 million accounts were breached during H1 2026. The United States led the world in overall breach volume, accounting for 29% of all global incidents. France took second place, followed by Brazil, India, and the United Kingdom.
Surfshark’s report highlighted a notable regional shift toward Europe, which surpassed North America in total breached accounts during the second quarter of 2026. One in every three breached accounts globally originated from Europe during this period, with 58% of all European leaks tied specifically to France. Furthermore, European nations claimed four of the top five spots for the highest breach density per 1,000 residents, led by France and Poland, while the United States ranked third, followed by Portugal and Lithuania.
To help users reduce their exposure and safeguard their digital footprint, Surfshark’s Chief Security Officer shared three key practices. Users should treat all personal information as sensitive by default and provide it online only when absolutely necessary. Additionally, real details should be strictly reserved for official or legally required forms. Finally, individuals can minimize risk during standard sign-ups, app registrations, and non-essential services by using aliases, secondary email addresses, or email-masking services.