Zenith Bank Probes Cyber Incident Exposing Contact Data

In Short

• Zenith Bank says it is investigating unauthorised access to limited customer data.
• The exposed information includes email addresses and phone numbers.
• The bank says its digital channels and core banking services remain secure and operational.

What Happened

Zenith Bank told customers it is investigating a cyber incident after attackers gained unauthorised access to limited customer information, including email addresses and phone numbers. The update was sent to customers by email on August 4, 2026.

The bank said the incident is connected to a wider global attack affecting multiple organisations. It also said it activated incident response protocols immediately. Incident response protocols are the steps a company follows to contain and fix a security breach, like an emergency plan for cyberattacks.

Zenith Bank said the incident did not disrupt its core banking operations. The bank added that its banking services and digital channels remain secure and fully operational.

The bank urged customers to watch for phishing and social engineering attempts after the incident. Phishing is when attackers pretend to be a trusted organisation to trick people into sharing secrets, like a fake “bank support” message asking for your password.

Zenith Bank advised customers not to share passwords, PINs, One-Time Passwords (OTPs), or other security credentials over email, SMS, or phone calls.

Why It Matters

Even when a breach is limited to contact details, it can raise the risk of targeted scams. Email addresses and phone numbers can be used to personalise phishing messages, trigger SIM swap attempts, or impersonate bank staff.

The incident also lands amid rising cyber threats across Africa. INTERPOL’s African Cyberthreat Assessment Report 2026 says artificial intelligence is enabling 55% of reported cybercrimes on the continent, by helping criminals automate attacks at scale.

For banks and fintechs, fast disclosure and clear customer guidance are now part of trust and risk management. For customers, the practical takeaway is simple, treat unexpected messages as suspicious, and never share login or transaction codes outside official channels.