Menu

Nigeria logged 390,800 leaked online accounts in the first half of 2026, pushing its cumulative total to 24.3 million compromised accounts since 2004, according to new data from cybersecurity company Surfshark. The country ranked 38th globally in breaches between January and June 2026, underscoring its persistent exposure to cyberattacks.

Surfshark’s latest breach monitoring report shows that 313.4 million accounts were compromised worldwide in H1 2026. The United States accounted for the largest share – 29% of all breaches – followed by France, Brazil, India, and the United Kingdom.

The company also highlighted a significant regional shift. Europe overtook North America in the number of breached accounts during Q2 2026. One in three compromised accounts globally originated from Europe, and France alone accounted for 58% of the region’s breaches. Four of the five countries with the highest breach density – France, Poland, Portugal, and Lithuania – were European, with the US being the only non-European country in the top five.

Surfshark’s Chief Security Officer, Tomas Stamulis, warned that data stolen years ago continues to resurface in new fraud schemes. “Information taken in breaches years ago can remain in circulation for a long time, resurfacing in new fraud schemes, and used to target people long after the original incident,” he said. Even recently stolen data, he added, may be weaponised years later through account takeovers, identity abuse, scams, and financial theft.

Nigeria remains one of the most affected countries in Sub-Saharan Africa, ranking third in the region for total compromised accounts since 2004. Surfshark’s data shows that 7.5 million unique Nigerian email addresses have been breached, along with 13 million leaked passwords, leaving 54% of affected users vulnerable to account takeovers that could lead to identity theft, extortion, or other cybercrimes.

Statistically, Surfshark estimates that 10 out of every 100 Nigerians have been impacted by data breaches, reflecting the scale of exposure in Africa’s largest digital economy.

To reduce risk, Stamulis advised users to treat all personal information as sensitive and disclose it only when absolutely necessary. He recommended using aliases, secondary email addresses, or email masking tools for non-essential online interactions.

Surfshark’s full global breach statistics and Nigeria-specific data are available on its research portal. The Netherlands-based cybersecurity firm offers products including an audited VPN, certified antivirus, a data leak warning system, and an online identity generator. It has been recognised by CNET, TechRadar, and the FT1000 ranking of Europe’s fastest-growing companies.