NITDA Says It is Investigating SureBet247

National Information Technology Development Agency (NITDA), has said it is investigating possible security and data breach at SureBet247

NITDA is the government organization responsible for implementing the country’s National Information Technology Policy as well as overseeing enforcement of its Data Protection Regulations .

Mr. Kashifu Inuwa Abdullahi, director-general, and CEO of NITDA, told iAfrikan that he has givem an order for the incident to be investigated by NITDA’s Data Breach Investigation Team.

This follows a frustrating period since December 2019 during which Troy Hunt, an Australian security researcher and Founder of HAVE I BEEN PWNED, and iAfrikan has been trying to alert SureBet247 and have them take the necessary steps as per acceptable industry standards as well as suggested by the Nigerian Data Protection Regulation.

During January 2019 the NITDA introduced the Nigeria Data Protection Regulation (‘NDPR’), and depending on how their findings and investigations go into SureBet247, the betting company and/or its suppliers could be in violation of some parts of the NDPR.

“We are also sending a letter to the affected company to provide further details before we make our conclusions. NITDA appreciates the efforts of people like you who genuinely seek to reduce the flagrant breach of personal data globally,” reads part of the message the NITDA sent to iAfrikan.

Possible violation of data regulations and more frustration with Surebet247

As mentioned in the initial article, it has been quite frustrating trying to engage with SureBet247 and getting the company to take the potential data breach seriously and alert its customers and portal users of the potential risks. Furthermore, and as mentioned in the NDPR, the company (among many other things) would be required to have a “Data Protection Officer” who would be responsible for communicating with “Data Subjects” and handling any issues relating to data protection. Thus far, it is highly probable that SureBet247 does not have such a role active.

I mention this because after experiencing frustration with the Nigerian betting company’s customer support agents, Sheriff Olaniyan, company’s co-founder and Managing Director, sent the following message to iAfrikan at 13h53 CAT on 4 January 2020:

“Hi iAfrikan , The management of surebet247 seriously frown at this malicious news been promoted by your organization. We will not hesitate to take legal action if you don’t stop and bring this down. No customer data of ours was hacked or exposed ,you have many betting company names listed on the so called list why this personal attack on surebet247. It’s obvious there is a motive around this , you post fake news without disclaimer and your informant do not provide you customer list from any of the betting company claimed to be hacked. Names posted on your list told us how your informant was asking for payment and this was demanded from us , this is pure blackmail and you reported this news so personal without evidence. We will appreciate you stopped right now.”

To date, we still await the legal action Olaniyan alluded to or any further communication from the company. This, after he sent a follow-up message in which he said their head of legal (note: not their Data Protection Officer as stipulated in the NDPR) will deal with the matter “appropriately.” Olaniyan concluded by saying “We will appreciate you stop and take this down immediately.”

At this stage, it is probably important to explain why the initial article focussed on SureBet247 even though the data dump contained information (which we would only later piece together) from betting operators and software development companies. It’s simple, the initial contact from the anonymous source mentioned, in the e-mail subject “Dumps surebet247.com and more.” Looking into the data at a glance, it also becomes apparent why Surebet247 was the main focus – SureBet247 constituted the bulk of the data and code dump.