Nigeria ranks as the 34th most breached country in first quarter (Q1) 2026, with 281.5k leaked accounts. Globally, a total of 210.3 million accounts were breached, with the US ranking first and amounting to 29 per cent of all breaches from January through March.
France took second place, while India is third, followed by Brazil and the UK, according to Surfshark’s quarterly analysis of global data breaches.
Since 2004, Nigeria is the third in Sub-Saharan Africa, with 24.1million compromised user accounts. A total of 7.5million unique emails were breached from Nigeria. 13 million passwords were leaked together with Nigerian accounts, putting 54 per cent of breached users in danger of account take over that might lead to identity theft, extortion or other cybercrimes.
Statistically, 10 out of 100 Nigerian people have been affected by data breaches.
The scope of exposed information often extends to highly sensitive personal data, such as Social Security Numbers (3.9k), financial data, e.g., payment card numbers (1.6k), and contact information, such as phone numbers (1.9million) and addresses (925.8k).
Globally, the number of breached accounts tripled in Q1 2026 compared to the same period in 2025 and increased by 22per cent compared to the last quarter of 2025.
An important fact is that, last year, 20.2per cent of companies reported using artificial intelligence (AI), up from 8.7per cent in 2023 — meaning adoption has more than doubled over the past two years. Do the figures for recent AI adoption and the increase in data leaks correlate?
The Chief Security Officer at Surfshark, Tomas Stamulis, said as companies rapidly adopt AI, they increase the amount of user data stored, expand the number of digital systems use, and integrate more platforms to manage larger volumes of user data.
“These AI-driven systems also collect and log more detailed user information for automation, analytics, and model improvement. While this improves the company’s efficiency, it also means there are many more systems for businesses to secure, more opportunities for error, and more points where sensitive information such as user credentials and personal data can be exposed. As a result, hackers now have a larger and more complex environment to exploit and execute attacks, including data breaches,” Stamulis explained.
With data breaches becoming a daily risk for companies, Stamulis expressed deepest concerns about businesses forcing users to create accounts and provide personal information to complete an online purchase when there is no clear need for it.
“For people, a data leak means their personal information is forever on the internet; it’s not a one-time threat that disappears after a user changes their compromised email address and password. It becomes a constant security risk as hackers reuse leaked data, package it into ‘combo lists,’ combine it with new leaks, and resell it repeatedly.
“So even after 10 or 20 years, leaked data is still valuable and can be used against a user to commit fraud, gain access to more data, and steal money,” Surfshark’s Chief Security Officer said.
He reminded people of the main habits of personal data hygiene in the age of AI: “Provide your real data, such as your primary email address, telephone number, home address, and other sensitive personal information, only when there is a critical need, such as filling out official forms; in other cases, use an alternative identity or email masking services; avoid providing your data unless necessary.”
