The Breach That Was Kept Quiet

Data protection: Under the Nigeria Data Protection Act 2023, a data controller that becomes aware of a personal data breach likely to result in a risk to data subjects must notify the Nigeria Data Protection Commission within 72 hours of becoming aware. ZuriPay became aware on 4 March, so notification was due by 7 March. It did not notify. It must also communicate the breach to affected data subjects without undue delay where there is a high risk. BVN, account names and transaction histories are sensitive financial data, so the risk threshold is clearly met.

The 10 March statement: The statement that 'no customer data was affected' was false. That is a breach of the accountability and transparency principles and may amount to an offence. It also increases the risk of enforcement action, compensation claims and reputational damage.

Listed company disclosure: As an NGX-listed issuer, ZuriPay must disclose material information promptly and avoid selective disclosure. A breach affecting 12,000 customers and attracting regulatory attention is potentially material. The chief executive's desire to protect the share price is not a lawful reason to withhold information. The company should issue an accurate market statement through the proper channel, correcting the earlier statement, and should inform the SEC and NGX as required.

Consequence: Delay and misstatement are likely to aggravate penalties. The company should not wait for the journalist to force disclosure.

Immediate governance steps:

1. Convene a board meeting and record the timeline of what was known, when, and by whom. The board's failure to be informed until 20 March is itself a governance failure.
2. Appoint an independent forensic firm to establish the cause, scope and whether data was exfiltrated. Preserve logs and evidence.
3. Notify the NDPC, affected customers, insurers and law enforcement as appropriate. Correct the public statement promptly.
4. Engage external counsel and a crisis communications adviser. All public statements should be accurate and consistent.
5. Appoint a data protection officer and establish a breach response plan with clear escalation to the board.
6. Review third-party and API security, patch management and access controls.

Ethics: The chief executive's instruction to conceal information conflicts with honesty, accountability and the duty to act in the company's best interests. The board should consider whether his position is untenable and should not allow him to control the investigation or communications. Whistleblowers who raised the issue must be protected.

Audit committee: It should oversee the investigation, challenge management's timeline, review the adequacy of disclosures and ensure the external auditor is informed. It should also review whether the risk committee had been monitoring cyber risk.

Technical remediation:

• Complete an inventory of APIs and remove or patch exposed endpoints.
• Introduce mandatory patch SLAs and vulnerability scanning.
• Enforce multi-factor authentication and least-privilege access.
• Encrypt sensitive data at rest and in transit; tokenise BVN and account data where possible.
• Segment networks and monitor outbound data transfers.

Governance reforms:

• Appoint a qualified data protection officer with direct access to the board.
• Establish a board-level technology and cyber risk committee, or assign clear responsibility to the audit committee.
• Adopt a data breach response plan with a 24-hour internal escalation rule to the board.
• Require annual independent cyber audits and penetration tests.
• Train staff and directors on NDPA 2023, market disclosure rules and whistleblowing.
• Include cyber and data protection metrics in executive scorecards.
• Review vendor and affiliate contracts for security, notification and audit rights.

Cultural reforms:

• Make candour a condition of employment and board service.
• Protect whistleblowers and investigate retaliation.
• Publish a clear customer remediation plan, including credit monitoring where appropriate.

Monitoring: The board should receive a remediation tracker with owners and deadlines, and the audit committee should report progress to shareholders. A repeat breach would be evidence of systemic failure, not bad luck.