The Nigeria Data Protection Commission has launched an investigation into an alleged data breach involving Remita Payment Services Ltd., Sterling Bank, and other organisations.

The commission disclosed the development in a statement issued on Sunday, following claims by Bytetobreach — a platform known for hacking companies to access sensitive information, that it had breached several firms, including Sterling Bank and Remita.

In the statement signed by the Head of Legal, Enforcement and Regulations at the NDPC, Babatunde Bamigboye, the commission said the probe will examine the nature and categories of personal data potentially compromised.

The agency added that the investigation will assess the nature and scope of the alleged breach, the potential risks to affected data subjects, and the remedial actions taken where any compromise is confirmed.

“In line with the Commission’s procedure, Notice of Investigation was duly served on the 1st of April, 2026. Relevant parties and individuals have been providing information for the purpose of addressing the incident.

“The aim of the investigation is to ensure that data subjects are protected with appropriate technical and organisational measures.

“The investigation by NDPC covers, among others, the types of personal data involved, the nature and scope of the alleged breach, the risk to data subjects and the mitigation measures carried out where a breach is confirmed.

“The Commission’s National Commissioner/CEO, Dr Vincent Olatunji, has directed that organisations that employ digital payment systems without putting in place appropriate technical and organisational measures as mandated under the Nigeria Data Protection Act, 2023 (NDP Act), will also be examined as part of a wider effort to ensure the integrity of the ecosystem,” NDPC said.

In May 2025, the NDPC said it would resolve a data breach dispute involving Meta, following a $220 million fine imposed by the Federal Competition and Consumer Protection Commission on the parent company of WhatsApp and Facebook over multiple data privacy violations.