The Ekiti State Universal Basic Education Board (SUBEB) has removed an open online bucket that had exposed personal details of staff and applicants.
The unprotected directory had contained sensitive documents, including passport photographs, identity cards, academic credentials and curricula vitae. It also revealed details of security operatives who had applied for roles, alongside raw website code.
The exposed files have since been replaced with an archive of old government press releases from 2013. At the time of press, neither SUBEB nor the State Ministry of Education, Science, and Technology had issued a public statement on the development.
Nigeria’s Data Protection Act, signed into law in June 2023, requires public institutions to safeguard personal information, appoint data protection officers and notify affected individuals and the Data Protection Commission in the event of a breach.
There is no indication that SUBEB has taken such steps. Breaches of this nature pose risks of identity theft, impersonation and fraud, while also potentially endangering security personnel whose details were exposed.
Similar lapses have been recorded in other states, with agencies later removing public access to sensitive data.
