Nigerian Passport Data Breach Sparks Public Outrage

On June 23, 2025, a disturbing incident involving the data breach of a Nigerian passport applicant surfaced on social media, highlighting the country’s ongoing struggles with data security. Oluwadamisi Awe, a Nigerian citizen, shared her experience on X, detailing how she received a WhatsApp message from a stranger who had obtained her passport application slip. Shockingly, the slip was used to wrap akara (fried bean cakes) purchased from a roadside vendor. The message included a photo of the slip, which contained sensitive personal information such as her passport number, full name, and birth date, sparking public outrage.

The Nigeria Immigration Service (NIS), responsible for processing passport applications, responded to the incident via its X account. The NIS emphasized its commitment to data privacy and protection, stating that it utilizes robust systems and protocols to safeguard personal information. However, the agency acknowledged that breaches often occur due to the involvement of unauthorized third parties, such as business cafes or touts, during the passport application process. The NIS advised applicants to use the official portal for applications and to avoid engaging with unscrupulous individuals or unauthorized agents to protect their sensitive data.

This incident is part of a troubling series of similar data breaches in Nigeria. In 2024, investigative reports exposed platforms selling Nigerian citizens’ biodata, including BVNs, NINs, and account information, for as little as ₦100. Additionally, Meta was fined $220 million for the unauthorized harvesting of Nigerian user data, highlighting the extent of data abuse in the country. Despite these high-profile cases, enforcement of existing data protection laws and policies remains inconsistent, leaving citizens with little recourse when their private information is breached or exploited.

Experts attribute the data security crisis to a fragmented data infrastructure. Government agencies such as the NIS, the National Identity Management Commission (NIMC), and the Nigeria Data Protection Commission (NDPC) often operate in silos with unclear mandates, overlapping roles, and limited coordination. Although the NIS has launched digitization efforts through its Enhanced E-Passport system, much of the application process remains manual, leading to vulnerabilities in data disposal protocols. Printed documents like Awe’s slip are easily discarded or leaked into informal networks, ending up with touts or vendors.

The real-world impact of unauthorized data exposure is significant. Victims of data leaks face identity theft, scams, and personal harassment. In Awe’s case, she received lewd messages from the stranger who found her data. Repeated scandals undermine public trust in agencies like the NIS, Correctional Services, and financial institutions. If citizens cannot trust the systems that govern identity, security, and mobility, national development is imperiled. Data insecurity also has far-reaching consequences for international business and diplomacy, deterring foreign investors and weakening compliance with global regulations.

Advocacy groups, cybersecurity professionals, and policy experts agree that urgent reform is needed. Clear agency roles must be defined, with coordinated mandates, secure communication channels, and shared incident-response protocols. Public institutions must be held to the same data protection standards as private companies, adopting regular third-party audits, staff training, and secure disposal methods for physical and digital documents. Transparency must be promoted, with agencies publicly disclosing root cause analyses and follow-up actions when breaches occur. The NDPC needs more authority, funding, and staffing to investigate, enforce, and educate the public on their data rights. Until these reforms are implemented, Nigerians remain at risk, vulnerable to exploitation, fraud, and humiliation in a system that too often treats their personal information with disregard. The akara-wrapped passport slip may fade from the news cycle, but the implications must not.