'On the preponderance of caution' — How MTN Nigeria navigated 72-hour countdown in data breach incident - Technology Times

MTN Nigeria faced a 72-hour data breach countdown following a recent cybersecurity incident that triggered coordinated responses across multiple jurisdictions of its parent company in South Africa, Technology Times has learnt.

MTN Nigeria faced a race against time in complying with Nigeria’s 72-hour data breach notification requirement following the recent cybersecurity incident announced by its parent company, MTN Group of South Africa.

The move underscores the telecoms operator’s commitment to local regulatory obligations amid growing concerns over data privacy and protection in Nigeria’s digital ecosystem, according to Oluwatoyin Araromi, Head of Compliance and Ethics and Data Protection Officer at MTN Nigeria.

Oluwatoyin Araromi, Head of Compliance and Ethics and Data Protection Officer at MTN Nigeria. Image credit: LinkedIn.

“So recently we had a data threat and, as you know, we’re in several jurisdictions,” Araromi says. “When we were informed by the group in South Africa, other entities were also informed. But because we had an obligation of 72 hours, irrespective of what the Protection of Personal Information (POPI) Act in South Africa prescribed, we had to inform them that we will need to inform our own regulator.”

MTN Nigeria: We acted on the preponderance of caution

MTN Nigeria, the nation’s largest mobile network operator (MNO) by subscribers, accounted for 90,494,670 active phone lines, representing about 52.4% of the 172,708,410 lines in the telecoms market as of Q1 2025, official data by the Nigerian Communications Commission shows.

Araromi, who dropped the hint while speaking during a virtual session hosted recently by Advocaat Law Practice, and titled “Data Breaches: Causes, Prevention, Reporting and Compliance,” says the company acted on “the preponderance of caution” in alerting Nigerian authorities about the potential impact of the data threat, even before confirming whether the incident affects customers in the country.

“So recently we had a data threat and, as you know, we’re in several jurisdictions,” Araromi says. “When we were informed by the group in South Africa, other entities were also informed. But because we had an obligation of 72 hours, irrespective of what the Protection of Personal Information (POPI) Act in South Africa prescribed, we had to inform them that we will need to inform our own regulator.”

The data protection officer adds that the threat was initially flagged as a form of blackmail. “Somebody was saying I have this and I’ll expose it tomorrow,” she says, explaining that MTN Nigeria chose a proactive stance by disclosing preliminary information to its regulator.

MTN Nigeria faced a 72-hour data breach countdown following a recent cybersecurity incident that triggered coordinated responses across multiple jurisdictions of its parent company in South Africa, Technology Times has learnt. Image credit: Image FX.

MTN Nigeria, the nation’s largest mobile network operator (MNO) by subscribers, accounted for 90,494,670 active phone lines, representing about 52.4% of the 172,708,410 lines in the telecoms market as of Q1 2025,

“We are not sure if it’s true. We are not even sure if it affects Nigeria, but we will keep you updated,” Araromi tells attendees at the event. “That’s a risk management way to ensure that you are not exposed.”

MTN Nigeria is required under Nigeria’s data protection rules to report a data breach within 72 hours of becoming aware of it, a compliance window meant to protect consumers and strengthen accountability among data controllers and processors.

In a statement issued by MTN Group, the South African-based telecoms multinational confirms it has experienced “a cybersecurity incident that resulted in unauthorised access to personal information of some MTN customers in certain markets.” The group says its core network, billing systems and financial services infrastructure remain secure and fully operational.

MTN Nigeria faced a 72-hour data breach countdown following a recent cybersecurity incident that triggered coordinated responses across multiple jurisdictions of its parent company in South Africa, Technology Times has learnt. Image credit: Image FX.

MTN has urged customers to remain vigilant and observe standard cybersecurity precautions, including updating apps and devices, using strong passwords, and enabling multi-factor authentication where available.

“An unknown third-party has claimed to have accessed data linked to parts of our systems. At this stage we do not have any information to suggest that customers’ accounts and wallets have been directly compromised,” MTN Group says.

The operator says it has activated cybersecurity response protocols, involving the South African Police Service (SAPS), the Hawks, and relevant country authorities. MTN Group also confirms that it is notifying affected customers “in compliance with local legal and regulatory obligations.”

As digital usage rises across Nigeria and the broader African region, telecoms operators like MTN are increasingly in the spotlight over how they protect personal data, especially as more consumers adopt digital financial services, mobile apps and internet-based platforms.

MTN has urged customers to remain vigilant and observe standard cybersecurity precautions, including updating apps and devices, using strong passwords, and enabling multi-factor authentication where available.

The company reiterates its commitment to privacy, saying “the privacy of information is our top priority,” and that it “remains committed to safeguarding the integrity of our systems and the trust placed in us by our customers and other stakeholders.”

Nigeria’s data protection watchdog, the Nigeria Data Protection Commission (NDPC), which continues to strengthen its data protection framework , mandates that organisations report suspected data breaches promptly to regulators and, where necessary, affected individuals—a step that aligns the nation with global data privacy norms.