The Nigeria Police Force has arrested members of a syndicate behind several unauthorised identity verification platforms that illegally harvested Nigerians’ personal information under the guise of accessing the National Identity Management Commission database.
The police said eight suspects had been arrested in connection with the offence, while efforts were ongoing to apprehend others.
The operation, carried out by the National Cybercrime Centre, followed a petition by the NIMC Director-General, Abisoye Coker-Odusote, over the unlawful distribution and commercialisation of Nigerians’ personally identifiable information.
Addressing a joint press briefing in Abuja on Thursday, Deputy Force Spokesman, Victor Isuku, said the cybercrime centre deployed advanced digital forensic techniques to trace the culprits and their illicit domains.
“The Nigerian Police Force National Cyber Crime Centre was able to achieve these great feats through the use of digital forensic techniques, which aided in identifying these threat actors and domains involved in this unlawful sale and verification of NIN-linked PPI, which is personally identifiable information.
“The actors behind this heinous act were Hamzat Lukman and Babalola Tolani Suleiman, arrested in Kwara and Lagos States, respectively. Lukman, a software developer, created and hosted the domain goverify.com.ng on behalf of Suleiman for commercial verification purposes. He also hosted three other domains for the same purpose,” Isuku explained.
He said further investigations led to the arrest of other collaborators, including Nura Bello and Ibrahim Abubakar, who was linked to idfinders.com.ng.
“Other arrested suspects are Shoara Kehinde, Abubakar Amisu, Abdullahi Salisu, and Ashiru Sanni.
“Meanwhile, other domains used to perpetrate this cyber intrusion include verifymyNIN.com, triplus.ng goverify.com.ng idfinder.com.ng verifyforme.com.ng subpoint.com.ng verify.datashop.com.ng championtech.com.ng anyverify.com.ng cremetech.com.ng nickverify.humanity.com.ng, inventor.com.ng, “he added.
Isuku said efforts have been intensified to apprehend other shadow perpetrators who engage in illegal distribution, commercialisation, and unlawful access to government databases and dismantle syndicates responsible for carrying out cyber-related crimes and offences.
He said the Inspector-General of Police, through the cybercrime unit, was committed to dismantling criminal syndicates targeting critical national infrastructure.
“The IG has again reaffirmed the commitment of the police force under its able leadership to combating all forms of cyber crimes as well as safeguarding national digital assets, reinforcing data privacy and protecting the integrity of citizens’ identification data. Thank you very much
“This operation is a milestone for the Police, for NIMC, and for Nigeria. We remain committed to safeguarding national digital assets, reinforcing data privacy, and protecting the integrity of citizens’ identification data,” Isuku said.
Director of the NPF-NCCC, CP Ifenayi Uche, clarified that contrary to widespread fears, the NIMC database itself was never breached.
“When the case was reported, we conducted vulnerability assessments and penetration tests. We confirmed there were no breaches in the NIMC system. What we uncovered was the existence of third parties who created phishing links that mimicked NIMC’s website to harvest Nigerians’ personal data for commercial purposes,” he said.
He added that the suspects had built their own parallel databases with stolen information, which they then sold to unsuspecting clients.
Uche noted that 13 out of 14 fraudulent domains identified in the operation have been successfully taken down.
“Out of the 14 domains that were reported by NIMC, we’ve been able to take down 13.
“We were also able to arrest eight of those behind those malicious domains, and the prosecution will be done after this press briefing. ”
Speaking at the joint press briefing, NIMC DG, Odusote, assured Nigerians that the commission had intensified safeguards to protect citizens’ data.
“The National Identity Management Commission remains steadfast in protecting the integrity of Nigeria’s national identity database. We have recently upgraded our systems to accommodate up to 250 million registrations, decentralised enrolment processes to the ward level, and strengthened our cybersecurity architecture,” she said.
She urged Nigerians to avoid patronising unauthorised agents or business centres, stressing that enrolment is free at all approved NIMC centres.
“There is only one official website citizens should use; only authorised channels for enrolment, modification, and verification,” Odusote said.
