August 5, 2026
August 5, 2026
Zenith Bank Hack Claims: What Nigerians Must Know Now
Reports of an alleged Zenith Bank data breach have raised urgent questions about customer privacy and banking security. But was the entire bank hacked? Here is what court documents, earlier cybercrime cases and verified evidence actually reveal.
Reports of an alleged Zenith Bank data breach have raised urgent questions about customer privacy and banking security. But was the entire bank hacked? Here is what court documents, earlier cybercrime cases and verified evidence actually reveal.
A new cybercrime case involving Zenith Bank highlights the risks facing Nigerian bank customers - but the available evidence requires careful interpretation.
What the Reported Zenith Bank Hack Actually Involves
Reports that “Zenith Bank was hacked” have circulated across Nigeria’s digital space, creating understandable concern among customers. However, the verified facts do not currently support the conclusion that Zenith Bank’s entire network or complete customer database was breached.
The latest incident concerns an eight-count criminal charge filed at the Federal High Court in Abuja. The Inspector-General of Police accused Zenith Bank Plc and three individuals of unlawfully accessing and disclosing the confidential financial records of Makers Island Company Limited.
The defendants named in reports about charge number FHC/ABJ/CR/349/2026 are:
Oluwaseyi Famousa, also reported as Famouza
Paul Oku
Yesu-Felix Abosede Alice
Zenith Bank Plc
According to Punch Newspapers, the alleged activity occurred between 4 December 2025 and 22 January 2026.
Police prosecutors alleged that the defendants used computer systems, electronic communication networks and banking infrastructure to access, obtain, alter, transmit or disclose the company’s financial information without lawful authority or a court order.
These remain allegations, not proven findings. No court has convicted the defendants or established that Zenith Bank’s entire core-banking system was compromised.
Was Zenith Bank’s Entire System Hacked?
There is presently no verified evidence of a bank-wide cyberattack affecting every Zenith Bank customer.
Available reports focus on the banking information of one corporate customer-Makers Island Company Limited. They do not establish that attackers obtained Zenith Bank’s complete customer database, captured millions of passwords or gained unrestricted access to every customer account.
This distinction matters.
A corporate account’s information could be accessed through several possible routes:
A compromised employee account
Insider misconduct or abuse of privileged access
Stolen customer credentials
Social engineering
Unlawful extraction of account statements
Compromised email communications
Weak access controls
A vulnerability in a connected payment or technology provider
Direct intrusion into a banking system
The publicly available reporting does not reveal which method was allegedly used. No independent forensic report has been published, and the precise quantity of information allegedly accessed remains unknown.
It is therefore more accurate to describe the incident as an alleged breach of a company’s Zenith Bank financial records, rather than a confirmed hack of the entire bank.
Before doing business with an unfamiliar person or organisation, Nigerians can use Profiled Nigeria’s verification tools to investigate identities and reduce their exposure to impersonation and digital fraud.
What Prosecutors Are Alleging
The police reportedly accused the defendants of conspiring to:
Access confidential bank statements and electronic records
Obtain and transmit protected financial information
Alter or redirect electronic communications
Manipulate account-related data
Compromise the integrity of banking records
Disclose information without lawful authority
Create an unlawful gain or disadvantage
The charges reportedly rely on provisions of Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024.
Sections cited across the reports include Sections 6, 11, 12(2), 16(1) and 27. Vanguard also reproduced an allegation referring to Section 14(7).
The law addresses offences such as unauthorised computer access, interception, system interference, computer-related fraud and conspiracy. The 2024 Cybercrimes Act amendment is available through WIPO Lex.
The Case Has Not Yet Established Guilt
When the case was reported on 13 July 2026, only the first defendant was present in court. The prosecution told Justice Hauwa Yilwa that the other defendants had been served, except Zenith Bank, which it expected to serve later that day.
The matter was adjourned until 21 July for arraignment.
At the time of writing, no reliably indexed public report confirms the outcome of that scheduled appearance, the pleas entered by all the defendants or a final judgment.
Readers should remember three important legal principles:
A criminal charge is an accusation, not proof of guilt.
Every defendant is presumed innocent until proven guilty.
Joining a bank as a defendant does not, by itself, establish that every customer account was compromised.
Publishing unproven claims as fact can mislead customers and unfairly damage reputations. Nigerians should rely on court records, official regulatory statements and credible journalism - not anonymous posts, edited screenshots or alarming voice notes.
Zenith Bank Faced an Earlier ₦500 Million Cyberattack Case
This is not the first reported cybercrime case involving Zenith Bank’s systems.
In May 2022, the Police Special Fraud Unit arraigned Kehinde Oladimeji, Olanrewaju Adeshina and Kolapo Stephen over an alleged plan to steal approximately ₦500 million from the bank.
The suspected scheme reportedly operated between 22 and 30 March 2022. Prosecutors alleged that the defendants conspired with people based in Holland and France to interfere with the bank’s computer systems.
According to Punch, a suspected syndicate attempted to recruit an information-technology employee at a bank. The employee was allegedly offered ₦200 million and assistance relocating outside Nigeria.
The reported plan was to leave critical system gateways open so that attackers could enter the network remotely and move money. The suspects allegedly intended to coordinate parts of the operation through Zoom.
The allegations illustrate how modern bank attacks can combine:
Insider recruitment
Remote collaboration
Privileged technical access
Deliberate weakening of security controls
Social engineering
Unauthorised system modification
Fraudulent transfers
The defendants pleaded not guilty. Public reports reviewed for this article do not establish a final conviction or conclusively confirm that ₦500 million was successfully stolen.
Insider Threats Can Be More Dangerous Than Password Attacks
Popular culture portrays hackers as strangers typing code in dark rooms. In reality, some of the most dangerous cyberattacks depend on human access.
An authorised employee may already have access to systems that an external attacker cannot easily reach. Criminals may attempt to bribe, deceive, blackmail or impersonate employees to bypass security controls.
A malicious insider could potentially:
View confidential account records
Override normal approval processes
Export sensitive information
Disable security alerts
Create or approve unauthorised transactions
Help external criminals understand internal systems
Conceal suspicious activity
Banks therefore need more than firewalls. Effective protection requires strict access controls, transaction monitoring, staff vetting, separation of duties, tamper-resistant logs and rapid investigation of unusual employee activity.
Unauthorised Transactions Do Not Always Mean a Bank Was Hacked
Individual Zenith Bank customers have also reported unexplained transactions.
In May 2026, an architect told the Foundation for Investigative Journalism that 25 airtime purchases of ₦19,900 each removed ₦497,500 from his account within minutes. He said he did not receive an OTP request.
Another customer alleged that ₦56,222 disappeared from her account after she had already reported suspicious activity.
These allegations deserve investigation, but an unauthorised debit does not automatically prove a core-banking breach.
Fraudulent transactions may result from:
Fake bank websites
Phishing messages
Stolen card information
Compromised mobile phones
SIM-swap fraud
Exposed email accounts
Fraudulent mobile applications
Customer-care impersonation
Account-recovery abuse
Insider involvement
Compromise at a third-party payment provider
Only a proper forensic investigation can identify the entry point and determine responsibility.
Why Fraudsters Target Customers During Banking Problems
Criminals regularly monitor complaints posted publicly on X, Facebook, Instagram and other platforms.
When a customer writes, “My transfer failed” or “Zenith Bank, please help me,” a fake customer-care representative may respond almost immediately. The impersonator may request a phone number, card details, OTP, PIN or login credentials.
Common warning signs include:
An unofficial account asking you to continue by direct message
A supposed bank employee requesting your OTP or PIN
A link that does not use the bank’s verified domain
Pressure to act immediately
A request to install a screen-sharing application
Instructions to dial an unfamiliar USSD code
A demand for payment before a transaction can be reversed
A request to move money into a “safe account”
No legitimate bank representative should ask for your PIN, password or complete card security credentials.
If an unknown individual claims to be a bank employee, business executive or investment adviser, verify that person independently through Profiled Nigeria’s identity verification service.
The 2023 Zenith Bank Outage Was Not a Confirmed Hack
Zenith Bank experienced significant service disruption on 3 May 2023. Customers were reportedly unable to use several banking services, leading to speculation about a possible cyberattack.
However, TechCabal reported that the outage followed a fire involving a backup power system at the bank’s primary data centre. The incident reportedly interrupted power while the bank attempted to activate disaster-recovery infrastructure.
A service outage can be disruptive without being a cyberattack.
Downtime may result from:
Power failure
Data-centre equipment damage
Software defects
Network configuration errors
Failed upgrades
Third-party service failures
Excessive transaction traffic
Cyberattacks
Evidence - not speculation - is required to distinguish between them.
What Zenith Bank Has Said About Security Breaches
Zenith Bank’s 2025 annual report states that no account holders were affected by security breaches during the reporting year.
That disclosure is relevant, but it does not conclusively resolve the new court case.
The alleged Makers Island activity reportedly began in December 2025 and continued into January 2026. The case may also involve the disclosure of corporate financial records rather than a mass breach affecting retail account holders.
The bank’s statement and the police allegations must therefore be reported together until a court or regulatory investigation establishes what happened.
What Nigerian Law Requires
Bank customers have a right to privacy and confidentiality.
The Central Bank of Nigeria states that banks must protect customer information from unauthorised access and must not disclose account details to third parties except where the customer consents or the law requires disclosure.
The Nigeria Data Protection Act 2023 also imposes responsibilities on organisations that control personal data. Where a breach is likely to endanger people’s rights, the organisation may be required to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it.
According to NDPC guidance, affected individuals should also be notified promptly when a breach presents a high risk, including exposure to identity theft or fraud.
If corporate banking records contain the names, signatures, contact details or identification documents of directors and employees, the incident could raise personal-data protection questions in addition to banking confidentiality concerns.
What to Do If Your Bank Account Is Compromised
If you notice an unauthorised transaction, speed is critical.
Take these immediate steps
Contact your bank through a verified telephone number, branch or official digital channel.
Ask the bank to restrict the account, card and digital-banking profile.
Obtain a written complaint reference number.
Request a full account statement and transaction details.
Change your banking and email passwords from a trusted device.
Contact your mobile network if you suspect a SIM swap.
Preserve SMS alerts, emails, screenshots, call logs and receipts.
Report suspected cybercrime to the appropriate Nigeria Police cybercrime unit.
Report a suspected personal-data breach to the NDPC.
Do not negotiate privately with an unknown recipient of stolen funds.
The CBN says customers should first lodge their complaint with the affected bank. If the bank fails to engage or resolve the matter within the prescribed period, the customer may escalate it to the CBN Consumer Protection Department.
The CBN complaints procedure says complainants should provide the transaction history, amount claimed, supporting records and evidence that the bank received the original complaint. Never include a PIN or password.
How Nigerians Can Reduce Their Exposure
Cybersecurity is a shared responsibility. Banks must secure their infrastructure, but customers must also protect their identities and access credentials.
Adopt these habits:
Never disclose an OTP, PIN or password.
Use a unique password for your banking email.
Activate transaction notifications.
Review statements frequently.
Reduce unnecessary card and transfer limits.
Avoid banking over public Wi-Fi.
Keep phones and banking applications updated.
Lock your SIM with a PIN.
Confirm unexpected payment instructions through another channel.
Verify unfamiliar people before sending money.
Avoid clicking banking links received through unsolicited messages.
Never allow a stranger to remotely control your screen.
For meetings involving property, romance, employment, investment or high-value transactions, Profiled Nigeria’s SecureMeet can provide a safer environment for establishing who is genuinely behind an online identity.
Conclusion
The alleged Zenith Bank hack is serious, but the evidence must not be exaggerated. The current criminal case concerns alleged unauthorised access to one company’s confidential financial records. It does not presently prove that Zenith Bank’s entire system or customer database was breached.
The case nevertheless exposes a broader danger: banking fraud can involve insider access, social engineering, compromised devices, false customer-care accounts and manipulation of digital records. Nigerians must treat unexpected messages, payment instructions and identity claims with caution.
Profiled Nigeria helps close the trust gap. Its verification platform enables users to investigate identities before committing money or sharing sensitive information, while SecureMeet supports safer interactions with people first encountered online.
Technology makes transactions faster, but verification makes them safer. Question unusual requests, protect your banking credentials and confirm who is on the other side before trust becomes loss.
A new cybercrime case involving Zenith Bank highlights the risks facing Nigerian bank customers - but the available evidence requires careful interpretation.
What the Reported Zenith Bank Hack Actually Involves
Reports that “Zenith Bank was hacked” have circulated across Nigeria’s digital space, creating understandable concern among customers. However, the verified facts do not currently support the conclusion that Zenith Bank’s entire network or complete customer database was breached.
The latest incident concerns an eight-count criminal charge filed at the Federal High Court in Abuja. The Inspector-General of Police accused Zenith Bank Plc and three individuals of unlawfully accessing and disclosing the confidential financial records of Makers Island Company Limited.
The defendants named in reports about charge number FHC/ABJ/CR/349/2026 are:
Oluwaseyi Famousa, also reported as Famouza
Paul Oku
Yesu-Felix Abosede Alice
Zenith Bank Plc
According to Punch Newspapers, the alleged activity occurred between 4 December 2025 and 22 January 2026.
Police prosecutors alleged that the defendants used computer systems, electronic communication networks and banking infrastructure to access, obtain, alter, transmit or disclose the company’s financial information without lawful authority or a court order.
These remain allegations, not proven findings. No court has convicted the defendants or established that Zenith Bank’s entire core-banking system was compromised.
Was Zenith Bank’s Entire System Hacked?
There is presently no verified evidence of a bank-wide cyberattack affecting every Zenith Bank customer.
Available reports focus on the banking information of one corporate customer-Makers Island Company Limited. They do not establish that attackers obtained Zenith Bank’s complete customer database, captured millions of passwords or gained unrestricted access to every customer account.
This distinction matters.
A corporate account’s information could be accessed through several possible routes:
A compromised employee account
Insider misconduct or abuse of privileged access
Stolen customer credentials
Social engineering
Unlawful extraction of account statements
Compromised email communications
Weak access controls
A vulnerability in a connected payment or technology provider
Direct intrusion into a banking system
The publicly available reporting does not reveal which method was allegedly used. No independent forensic report has been published, and the precise quantity of information allegedly accessed remains unknown.
It is therefore more accurate to describe the incident as an alleged breach of a company’s Zenith Bank financial records, rather than a confirmed hack of the entire bank.
Before doing business with an unfamiliar person or organisation, Nigerians can use Profiled Nigeria’s verification tools to investigate identities and reduce their exposure to impersonation and digital fraud.
What Prosecutors Are Alleging
The police reportedly accused the defendants of conspiring to:
Access confidential bank statements and electronic records
Obtain and transmit protected financial information
Alter or redirect electronic communications
Manipulate account-related data
Compromise the integrity of banking records
Disclose information without lawful authority
Create an unlawful gain or disadvantage
The charges reportedly rely on provisions of Nigeria’s Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended in 2024.
Sections cited across the reports include Sections 6, 11, 12(2), 16(1) and 27. Vanguard also reproduced an allegation referring to Section 14(7).
The law addresses offences such as unauthorised computer access, interception, system interference, computer-related fraud and conspiracy. The 2024 Cybercrimes Act amendment is available through WIPO Lex.
The Case Has Not Yet Established Guilt
When the case was reported on 13 July 2026, only the first defendant was present in court. The prosecution told Justice Hauwa Yilwa that the other defendants had been served, except Zenith Bank, which it expected to serve later that day.
The matter was adjourned until 21 July for arraignment.
At the time of writing, no reliably indexed public report confirms the outcome of that scheduled appearance, the pleas entered by all the defendants or a final judgment.
Readers should remember three important legal principles:
A criminal charge is an accusation, not proof of guilt.
Every defendant is presumed innocent until proven guilty.
Joining a bank as a defendant does not, by itself, establish that every customer account was compromised.
Publishing unproven claims as fact can mislead customers and unfairly damage reputations. Nigerians should rely on court records, official regulatory statements and credible journalism - not anonymous posts, edited screenshots or alarming voice notes.
Zenith Bank Faced an Earlier ₦500 Million Cyberattack Case
This is not the first reported cybercrime case involving Zenith Bank’s systems.
In May 2022, the Police Special Fraud Unit arraigned Kehinde Oladimeji, Olanrewaju Adeshina and Kolapo Stephen over an alleged plan to steal approximately ₦500 million from the bank.
The suspected scheme reportedly operated between 22 and 30 March 2022. Prosecutors alleged that the defendants conspired with people based in Holland and France to interfere with the bank’s computer systems.
According to Punch, a suspected syndicate attempted to recruit an information-technology employee at a bank. The employee was allegedly offered ₦200 million and assistance relocating outside Nigeria.
The reported plan was to leave critical system gateways open so that attackers could enter the network remotely and move money. The suspects allegedly intended to coordinate parts of the operation through Zoom.
The allegations illustrate how modern bank attacks can combine:
Insider recruitment
Remote collaboration
Privileged technical access
Deliberate weakening of security controls
Social engineering
Unauthorised system modification
Fraudulent transfers
The defendants pleaded not guilty. Public reports reviewed for this article do not establish a final conviction or conclusively confirm that ₦500 million was successfully stolen.
Insider Threats Can Be More Dangerous Than Password Attacks
Popular culture portrays hackers as strangers typing code in dark rooms. In reality, some of the most dangerous cyberattacks depend on human access.
An authorised employee may already have access to systems that an external attacker cannot easily reach. Criminals may attempt to bribe, deceive, blackmail or impersonate employees to bypass security controls.
A malicious insider could potentially:
View confidential account records
Override normal approval processes
Export sensitive information
Disable security alerts
Create or approve unauthorised transactions
Help external criminals understand internal systems
Conceal suspicious activity
Banks therefore need more than firewalls. Effective protection requires strict access controls, transaction monitoring, staff vetting, separation of duties, tamper-resistant logs and rapid investigation of unusual employee activity.
Unauthorised Transactions Do Not Always Mean a Bank Was Hacked
Individual Zenith Bank customers have also reported unexplained transactions.
In May 2026, an architect told the Foundation for Investigative Journalism that 25 airtime purchases of ₦19,900 each removed ₦497,500 from his account within minutes. He said he did not receive an OTP request.
Another customer alleged that ₦56,222 disappeared from her account after she had already reported suspicious activity.
These allegations deserve investigation, but an unauthorised debit does not automatically prove a core-banking breach.
Fraudulent transactions may result from:
Fake bank websites
Phishing messages
Stolen card information
Compromised mobile phones
SIM-swap fraud
Exposed email accounts
Fraudulent mobile applications
Customer-care impersonation
Account-recovery abuse
Insider involvement
Compromise at a third-party payment provider
Only a proper forensic investigation can identify the entry point and determine responsibility.
Why Fraudsters Target Customers During Banking Problems
Criminals regularly monitor complaints posted publicly on X, Facebook, Instagram and other platforms.
When a customer writes, “My transfer failed” or “Zenith Bank, please help me,” a fake customer-care representative may respond almost immediately. The impersonator may request a phone number, card details, OTP, PIN or login credentials.
Common warning signs include:
An unofficial account asking you to continue by direct message
A supposed bank employee requesting your OTP or PIN
A link that does not use the bank’s verified domain
Pressure to act immediately
A request to install a screen-sharing application
Instructions to dial an unfamiliar USSD code
A demand for payment before a transaction can be reversed
A request to move money into a “safe account”
No legitimate bank representative should ask for your PIN, password or complete card security credentials.
If an unknown individual claims to be a bank employee, business executive or investment adviser, verify that person independently through Profiled Nigeria’s identity verification service.
The 2023 Zenith Bank Outage Was Not a Confirmed Hack
Zenith Bank experienced significant service disruption on 3 May 2023. Customers were reportedly unable to use several banking services, leading to speculation about a possible cyberattack.
However, TechCabal reported that the outage followed a fire involving a backup power system at the bank’s primary data centre. The incident reportedly interrupted power while the bank attempted to activate disaster-recovery infrastructure.
A service outage can be disruptive without being a cyberattack.
Downtime may result from:
Power failure
Data-centre equipment damage
Software defects
Network configuration errors
Failed upgrades
Third-party service failures
Excessive transaction traffic
Cyberattacks
Evidence - not speculation - is required to distinguish between them.
What Zenith Bank Has Said About Security Breaches
Zenith Bank’s 2025 annual report states that no account holders were affected by security breaches during the reporting year.
That disclosure is relevant, but it does not conclusively resolve the new court case.
The alleged Makers Island activity reportedly began in December 2025 and continued into January 2026. The case may also involve the disclosure of corporate financial records rather than a mass breach affecting retail account holders.
The bank’s statement and the police allegations must therefore be reported together until a court or regulatory investigation establishes what happened.
What Nigerian Law Requires
Bank customers have a right to privacy and confidentiality.
The Central Bank of Nigeria states that banks must protect customer information from unauthorised access and must not disclose account details to third parties except where the customer consents or the law requires disclosure.
The Nigeria Data Protection Act 2023 also imposes responsibilities on organisations that control personal data. Where a breach is likely to endanger people’s rights, the organisation may be required to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it.
According to NDPC guidance, affected individuals should also be notified promptly when a breach presents a high risk, including exposure to identity theft or fraud.
If corporate banking records contain the names, signatures, contact details or identification documents of directors and employees, the incident could raise personal-data protection questions in addition to banking confidentiality concerns.
What to Do If Your Bank Account Is Compromised
If you notice an unauthorised transaction, speed is critical.
Take these immediate steps
Contact your bank through a verified telephone number, branch or official digital channel.
Ask the bank to restrict the account, card and digital-banking profile.
Obtain a written complaint reference number.
Request a full account statement and transaction details.
Change your banking and email passwords from a trusted device.
Contact your mobile network if you suspect a SIM swap.
Preserve SMS alerts, emails, screenshots, call logs and receipts.
Report suspected cybercrime to the appropriate Nigeria Police cybercrime unit.
Report a suspected personal-data breach to the NDPC.
Do not negotiate privately with an unknown recipient of stolen funds.
The CBN says customers should first lodge their complaint with the affected bank. If the bank fails to engage or resolve the matter within the prescribed period, the customer may escalate it to the CBN Consumer Protection Department.
The CBN complaints procedure says complainants should provide the transaction history, amount claimed, supporting records and evidence that the bank received the original complaint. Never include a PIN or password.
How Nigerians Can Reduce Their Exposure
Cybersecurity is a shared responsibility. Banks must secure their infrastructure, but customers must also protect their identities and access credentials.
Adopt these habits:
Never disclose an OTP, PIN or password.
Use a unique password for your banking email.
Activate transaction notifications.
Review statements frequently.
Reduce unnecessary card and transfer limits.
Avoid banking over public Wi-Fi.
Keep phones and banking applications updated.
Lock your SIM with a PIN.
Confirm unexpected payment instructions through another channel.
Verify unfamiliar people before sending money.
Avoid clicking banking links received through unsolicited messages.
Never allow a stranger to remotely control your screen.
For meetings involving property, romance, employment, investment or high-value transactions, Profiled Nigeria’s SecureMeet can provide a safer environment for establishing who is genuinely behind an online identity.
Conclusion
The alleged Zenith Bank hack is serious, but the evidence must not be exaggerated. The current criminal case concerns alleged unauthorised access to one company’s confidential financial records. It does not presently prove that Zenith Bank’s entire system or customer database was breached.
The case nevertheless exposes a broader danger: banking fraud can involve insider access, social engineering, compromised devices, false customer-care accounts and manipulation of digital records. Nigerians must treat unexpected messages, payment instructions and identity claims with caution.
Profiled Nigeria helps close the trust gap. Its verification platform enables users to investigate identities before committing money or sharing sensitive information, while SecureMeet supports safer interactions with people first encountered online.
Technology makes transactions faster, but verification makes them safer. Question unusual requests, protect your banking credentials and confirm who is on the other side before trust becomes loss.
