Remita, a Nigerian payment platform used to process salaries of most government and private sector workers, has asked its partners to urgently regenerate their API credentials and whitelist their IP addresses following reports of an alleged data breach that exposed at least three terabytes of data, including passports, National Identification Numbers, bank statements, Know Your Customer details of millions of users and confidential government Hardware Security Module secrets.

Remita made no mention of a security breach but only cited “some hitches” in its statement, a language many said was intended to downplay the alleged cyberattack.

“We are aware that there have been some hitches in the interface between our environment and yours between yesterday and today,” Remita wrote in an email on Tuesday, attributing the disruption to “ongoing efforts aimed at improving overall operational efficiency and service delivery”.  

The company promised full restoration of services by 3:00 p.m. on March 31, but mandated the regeneration of API keys, a move widely known as a standard first response to any cyber attack, not routine maintenance.

“To achieve full synchronisation of services at your end, you are required to re-generate your API credentials,” Remita said in the email.

The email message was sent the same day DarkWebInformer, an X account that tracks cyberattacks globally, reported a “massive breach” on Remita’s Amazon Cloud server.

X users alleged that a popular cyberhacker known as Bytetobreach claimed responsibility for breaching Remita’s database and exposing over 800 gigabytes of KYC documents, including national identity cards, international passports, photographs, bank statements, and utility bills belonging to customers.

Bytetobreach further claimed to have obtained MySQL and PostgreSQL databases, source code, Docker registries, 35,000 password hashes, government HSM keys, and major tools used to secure sensitive financial and government transactions.

For over a decade, Remita has been the go-to platform for processing salaries, allowances  and other payments on behalf of federal and state government agencies across Nigeria.