National Social Investment Management System (NASIMS) has leaked millions of federal government records in a major system oversight  which could be exploited by cyber criminals.

NASIMS is the central management platform for the administration and coordination of Social Investment Programmes under the Federal Ministry of Humanitarian Affairs, Disaster Management and Social Development

The major leak exposed everything from home addresses to work backgrounds of  tens of millions of Nigerians

According to the Cybernews research team, the exposed AWS S3 bucket stored over 23 million files, including passports, birth certificates, educational certificates, and N-Power-submitted applications.

N-Power is a social welfare scheme to combat youth unemployment. N-Power applicants use the NASIMS platform to apply to take part in the program.

“The implications of exposing 23 million application-related documents of N-Power candidates could be severe for the affected individuals. Identity theft, fraud, and targeted phishing attacks are the most likely risks for the leaks’ victims,” Cybernews research team said.

According to Cybernews research team, “Worryingly, the instance remains open to the public, even after multiple attempts to reach NASIMS administrators and relevant authorities in Nigeria. We have also reached out to the ministry behind NASIMS for a comment and will update the article once we receive a reply”

What data leaked, and why is it dangerous?

Documents stored on the exposed instance include different sets of citizens’ data. However, the team surmised that the leak revealed:

Full names

Dates of birth

Places of birth

National Identification Number (NIN)

Email addresses

Phone numbers

Home addresses

Work background

Education background

Exposing sensitive and personal data poses numerous threats to the individuals involved.

Most pressingly, attackers might utilize the information for identity theft and various fraud schemes. For one, malicious actors could try opening fraudulent bank accounts or use stolen identities for illicit activities, masking their own IDs.

“Another way attackers can exploit similar data sets is by exploiting the identities to access financial services or execute unauthorized transactions, potentially causing long-term financial damage to the victims,” Cybernews research team said.

Cybercrooks could also exploit the leak to carry out targeted phishing and social engineering attacks.

For example, malicious actors could attempt to masquerade as legitimate organizations in order to deceive individuals into providing even more sensitive data – such as login credentials – or downloading malware.

“The implications of exposing 23 million application-related documents of N-Power candidates could be severe for the affected individuals. Identity theft, fraud, and targeted phishing attacks are the most likely risks for the leaks’ victims.”

The leaks’ nature empowers attackers to craft spear-phishing attacks custom-made for each individual or group of individuals. Such attacks are hard to distinguish, as they often include targets’ personal details and other data points meant to lure in unsuspecting victims.

“Criminals could use the exposed data to offer fake job opportunities or promise assistance with the N-Power application process in exchange for payments or additional personal information, exploiting the candidates’ vulnerabilities,” the team explained.

Additional attack vectors involve risks to victims’ physical safety. For example, criminals could exploit leaked data to locate and target victims for various malicious purposes, such as stalking, harassment, or even burglary.

To avoid similar leaks in the future, Cybernews research team advised:

Change the access controls to restrict public access and secure the bucket. Update permissions to ensure that only authorized users or services have the necessary access.

Monitor retrospectively access logs to assess whether the bucket has been accessed by unauthorized actors.

Enable server-side encryption to protect data at rest.

Use AWS Key Management Service (KMS) to manage encryption keys securely.

Implement SSL/TLS for data in transit to ensure secure communication.

Consider implementing security’s best practices, such as regular audits, automated security checks, and employee training.

MTN Group, in collaboration with the Lagos State Government (LASG), has launched MyLagosApp, an innovative mobile application designed to improve productivity, enhance connectivity, and transform the lifestyle of Lagos residents.

It also aims to provide a centralised digital hub for accessing essential services, fostering a more efficient and connected Lagos.

Speaking at the official inauguration in Lagos, Karl Toriola, chief executive officer MTN Nigeria, described the app as a one-stop platform for information, services, entertainment, and hospitality.

He highlighted its role in facilitating e-governance and providing essential services to both residents and visitors.

“This app offers access to various services, including restaurant and accommodation reservations, transport options—both land and water—library access, and e-governance solutions. It is designed to simplify life for Lagosians while promoting efficiency and productivity,” Toriola said.

He emphasised that technological innovations like MyLagosApp drive economic growth by increasing productivity and improving societal well-being. He noted that Lagos, classified as a hyper-city with over 20 million residents, has the potential to become Africa’s most important city.

Toriola also revealed that Lagos State’s economy is larger than that of Kenya and reaffirmed MTN’s commitment to deepening investment in Nigeria. He disclosed plans to build a new headquarters in Eko Atlantic City and establish West Africa’s most advanced data centre, addressing the region’s need for large-scale tech infrastructure.

At a Fireside Chat, Oluwaseun Osiyemi, Lagos State Commissioner for Transport, noted that MyLagosApp would support the state’s multimodal transport policy, leveraging user data and feedback to enhance urban mobility.

Aisha Mumuni, chief digital officer, MTN, reiterated the company’s dedication to seamless connectivity despite power challenges, calling for increased collaboration to boost digital literacy.

Tokunbo Wahab, Commissioner for Environment and Water Resources, highlighted Lagos’ daily waste production of 13,000 tonnes and suggested that the app could aid waste management through advocacy, enforcement, and regulation.

Cybercriminals are targeting popular YouTube creators with fake copyright claims, forcing them to distribute cryptocurrency mining malware disguised as Internet restriction bypass tools to thousands of viewers.

Kaspersky Global Research and Analysis Team (GReAT) researchers have uncovered a sophisticated malicious campaign where threat actors blackmail YouTube content creators into distributing malicious software.

The attackers file two fraudulent copyright complaints against creators, then threaten a third strike – which would delete their YouTube channels. To avoid this, creators unknowingly promote malicious links, believing them legitimate to save their channels.

Kaspersky’s telemetry confirmed over 2,000 end users infected with the malware after downloading the tool, though the actual number of affected users is likely much higher. One compromised YouTube channel with 60,000 subscribers published several videos containing malicious links that garnered more than 400,000 views. The infected archive hosted on a fraudulent website recorded over 40,000 downloads.

The malware, dubbed as SilentCryptoMiner, exploits the growing demand for Internet restriction bypass tools. Kaspersky’s telemetry shows a significant increase in the use of legitimate Windows Packet Divert drivers—a technology commonly used in bypass utilities—with detections rising from approximately 280,000 in August to nearly 500,000 in January, totaling more than 2.4 million detections over six months.

The attackers specifically targeted users seeking these bypass tools by modifying a legitimate Deep Packet Inspection (DPI) circumvention utility originally published on GitHub.

Their malicious version maintains the original functionality to avoid suspicion, but secretly installs SilentCryptoMiner, which harvests computing resources to mine cryptocurrency without users’ knowledge or consent, significantly degrading device performance and increasing electricity costs.

“This campaign demonstrates a concerning evolution in malware distribution tactics,” said Leonid Bezvershenko, security researcher at Kaspersky’s GReAT. “While initially targeting Russian-speaking users, this approach could easily spread to other regions as Internet fragmentation increases globally.

“The scheme effectively leverages trusted content creators as unwitting accomplices, which works in any market where users seek tools to circumvent online restrictions.”

When security solutions detect and remove the malicious components, the modified installer encourages users to disable their antivirus protection with messages like “File not found, turn off all antiviruses and re-download the file, it will help!” — further compromising system security.

Kaspersky GReAT identified several indicators of compromise, including connections to domains like swapme[.]fun and canvas[.]pet, along with specific file hashes. The attackers demonstrate persistence, rapidly creating new distribution channels when previous ones are blocked.