NIN Data: NIMC Denies Breach, Investigates Tokenisation Agents

The National Identity Management Commission (NIMC) has dismissed claims circulating on social media that its National Identity Database (NIDB) was breached, even as the commission ordered an investigation into whether some authorised verification agents violated the terms of their access to identity data.

The controversy followed the circulation of a video alleging that Nigerians’ National Identification Numbers (NINs) and other personal information had been exposed and were available for sale online.

NIMC, however, described the claim as false and unfounded, saying the video was a recycled 2024 report that the commission had previously disclaimed.

In a statement issued by its Head of Corporate Communications, Kayode Adegoke, the commission said its National Identity Database had not been breached or compromised and that it maintains multi-layered security measures to protect the personal information of registered citizens and legal residents.

“Our systems are protected, and the commission remains committed to ensuring the safety and security of citizens’ identity information,” Adegoke said, urging Nigerians to disregard unverified information capable of creating unnecessary panic.

However, NIMC’s response also disclosed that its Director-General, Abisoye Coker-Odusote, had ordered a comprehensive investigation into the activities of tokenisation verification agents to determine whether any of them breached their licensing agreements, either directly or through sub-licensees.

The development places renewed attention on the security of Nigeria’s digital identity ecosystem, particularly the activities of third parties authorised to access identity information for verification and other services.

The commission has increasingly positioned the NIN as a key component of digital identity verification across telecommunications, financial services, immigration, taxation and other public and private-sector services. President Bola Tinubu’s assent to the NIMC Act 2026 has also strengthened the commission’s legal mandate around Nigeria’s foundational identity infrastructure.

Meanwhile, NIMC has highlighted its recently introduced NIN Authentication (NINAuth) platform, which provides web, application programming interface (API) and mobile-based identity verification services.

According to the commission, NINAuth requires the explicit consent of a NIN holder before personal information is shared for Know Your Customer (KYC) processes or other verification purposes. It is also designed to enable identity verification without unnecessary exposure of an individual’s raw NIN or other personal information.

The platform is expected to support identity verification for services including SIM registration, passport and immigration processing, tax-related transactions and financial services.

The latest development comes amid broader concerns over the protection of Nigerians’ personal information as more government and private-sector services become linked to the national identity system. In a previous publication, the Nigeria Data Protection Commission (NDPC) noted that allegations concerning NIMC data security had previously been investigated without the commission being found liable for a breach.

While NIMC maintains that its core database has not been compromised, the decision to investigate authorised verification agents indicates that the commission is also examining possible vulnerabilities around third-party access to identity information.

NIMC, however, urged Nigerians to rely on its official communication channels for information concerning the National Identity Management System and said it would continue working with relevant government and security agencies to strengthen data protection and counter misinformation.