Nigeria has recorded over 150,000 compromised accounts in the first half of 2025, after data breaches fell significantly in the second quarter, according to a new report by cybersecurity company Surfshark.
The report revealed a 73 percent drop in breaches between Q1 and Q2, falling from 120,000 to 31,800 incidents. However, despite the improvement, the high number of affected accounts underscores the country’s ongoing exposure to cyber threats.
“Today’s digital age requires all of us to share more and more personal information to carry out daily tasks. In the wrong hands, this data can be used to commit identity theft, for targeted scams, or sold on the dark web,” said Sarunas Sereika, product manager at Surfshark.
Since 2004, Nigeria has suffered 23.3 million breached accounts, making it the third most affected country in Sub-Saharan Africa. Of these, about 13 million included leaked passwords, leaving over half (56 percent) of users vulnerable to account takeovers, blackmail, or fraud.
Read also: The rise of autonomous intelligence and the need for adaptive cybersecurity
7.3 million unique Nigerian email addresses have appeared in various data leaks, and Surfshark estimates that roughly 10 out of every 100 Nigerians have experienced a data breach at some point, reinforcing the scale of the cybersecurity challenge.
While the decline in Q2 offers a glimmer of hope, Surfshark cautioned that data breaches remain a persistent threat.
“Cyberthreats are constantly evolving, and attackers are adapting their tactics. Strong security practices, frequent password updates, and enabling two-factor authentication remain essential.”
Globally, the number of leaked accounts surged from 70 million in Q1 to 94 million in Q2 2025, marking a 34 percent increase.
The United States topped the list with 42.5 million compromised accounts, followed by France (11.4 million), India (1.7 million), Germany (1.3 million), and Israel (1.2 million). When adjusted for population, France had the highest breach density with 172 leaked accounts per 1,000 residents, ahead of Israel (130), the U.S. (123), Singapore (26), and Canada (24).
Surfshark based its findings on information from 29,000 publicly available databases, aggregating and anonymising the data for analysis. Each email address was treated as a separate account, and some breaches included sensitive information such as passwords, phone numbers, IP addresses, and zip codes.
