Zenith Bank Plc listed on ExfilSquad leak site

• Ransomware group: ExfilSquad
• Country: Nigeria
• Sector: Financial Services
• Announcement date: July 26, 2026

ExfilSquad claims data breach at Zenith Bank Plc

The ransomware group known as ExfilSquad has listed Zenith Bank Plc on its leak site, claiming to possess a massive dataset. According to the announcement made on July 26, 2026, the group alleges that they have successfully executed a data breach against the institution, claiming to have obtained a comprehensive dataset that includes sensitive financial and customer information.

This type of activity is characteristic of modern ransomware operations, specifically the tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this stolen information on a public or semi-public leak site serves as significant leverage to pressure the victim into paying a ransom. While the specific details of the attack method remain unknown, the claim suggests that the institution's operational data and customer records may be at significant risk.

The group's announcement was made on July 26, 2026, the same date they claim the attack occurred. At this time, no screenshot was provided by the group to verify the contents of the alleged breach, and no information was provided regarding the specific ransom demand or the exact size of the files involved beyond the record count.

Details of the alleged data theft

The announcement made by ExfilSquad states that the stolen dataset is substantial, allegedly containing 90 million records. The group claims that this information is highly sensitive and includes a wide variety of data points that could be used for malicious purposes. The alleged data includes:

• Personally identifiable information (PII)
• Bank account information
• Financial data
• Government identifiers
• Customer contact information
• Banking support cases

The breadth of this alleged data suggests that the attackers may have gained access to deep layers of the institution's database, potentially touching upon both customer-facing information and internal support documentation. The inclusion of government identifiers and banking support cases indicates a high level of sensitivity regarding the identity and transaction history of the affected individuals.

About Zenith Bank Plc

Zenith Bank Plc is a multinational financial services provider headquartered in Nigeria. The bank offers a wide range of banking and financial solutions to individual and corporate clients, operating across various markets as a significant player in the financial sector.

Potential impact and industry implications

This alleged data breach may increase the risk of identity theft and fraud for the institution's customers. Given the sensitivity of the alleged data, customers may be subject to targeted phishing attacks, where attackers use the stolen contact information and banking details to craft highly convincing fraudulent communications. Such attacks often aim to trick individuals into revealing further credentials or transferring funds.

Furthermore, the institution may face legal consequences under Nigerian data protection regulations due to the potential exposure of customer information. The alleged volume of data may lead to significant reputational damage and could negatively impact the institution's operational processes. Information regarding the ExfilSquad group remains limited, making it difficult to attribute the attack to a specific known threat actor profile.

For organizations operating within the financial services sector, such incidents underscore the necessity of robust defensive measures. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining rigorous patch management schedules to close vulnerabilities, and employing advanced endpoint detection and response (EDR) tools. Additionally, organizations often focus on data encryption at rest and in transit, regular offline backups, and comprehensive employee training to recognize social engineering and phishing attempts. As data breaches become increasingly sophisticated, the ability to detect unauthorized data exfiltration is becoming as critical as the ability to prevent initial access.