Nigeria Revenue Service (NRS) Act has introduced strict penalties for the unauthorised disclosure of confidential information and documents by its staff, with offenders facing fines of up to N5 million, imprisonment for up to three years, or both.

The NRS Act is one of four bills recently signed into law by President Bola Tinubu, alongside the Nigeria Tax (Fair Taxation) Law, the Nigeria Tax Administration Law, and the Joint Revenue Board (Establishment) Law. The regulations will take effect on January 1, 2026.

In Part VI of the NRS Act, covering miscellaneous provisions, the law designates all internal records—including institutional information, memoranda, and communications—as confidential.

“Without prejudice to the provisions of any other Act concerning data privacy or data protection, institutional information or communication, all internal information, communications, documents or memoranda of the Service are confidential,” the law states.

It further warns that, “Except as otherwise provided under this Act, any other law or any enabling agreement or arrangement or as otherwise authorised by the Executive Chairman or management of the Service, any person who discloses or attempts to disclose institutional information, communication, document or memorandum of the Service is liable on conviction to a fine not exceeding N5,000,000 or imprisonment for a term not exceeding three years or both.”

The provision applies to all officials and individuals involved in the administration of the Act. The NRS also specified that business records, tax returns, notices, assessments, and documents relating to a person’s assets, liabilities, or profits must be “treated as secret.”

Exceptions to the confidentiality rule include disclosures authorised by the service, those mandated by court order, or situations where the information is needed for the enforcement of Nigeria’s tax laws.

The development follows a February 20, 2024, warning from the federal government cautioning civil servants in ministries, departments, and agencies (MDAs) against leaking sensitive documents to the public.

The Federal Inland Revenue Service (FIRS) has launched a national electronic invoicing system, seen as a significant step toward digitising the country’s tax infrastructure and boosting compliance among large corporate taxpayers.

The system, known as the Merchant-Buyer Solution (MBS), officially went live on August 1 after a successful pilot phase that began in November 2024. It is being rolled out in phases, starting with companies that have an annual turnover of at least ₦5 billion. According to FIRS, these large taxpayers represent over 5,000 businesses nationwide.

More than 1,000 companies — roughly 20% of eligible firms — have already integrated with the platform, including telecoms giant MTN Nigeria, which became the first to transmit live electronic invoices to the tax authority. Other major players such as Huawei Nigeria and IHS Towers are completing their onboarding and are expected to go live in the coming days.

“The launch of the e-invoicing regime ushers in a new era of transparency, accuracy, and real-time monitoring of commercial transactions,” Dare Adekanmbi, who is the spokesperson for Zacch Adedeji, FIRS Chairman, said in a statement on Sunday.

The e-invoicing solution forms part of the agency’s broader Electronic Fiscal System (EFS), which is designed to ensure authenticity and completeness of invoice data and limit opportunities for tax evasion. It also aligns with Nigeria’s Revenue Services Reform Act — a legislative framework aimed at harmonising revenue collection and providing a single source of truth for government receipts.

The FIRS said it is working in collaboration with the National Information Technology Development Agency (NITDA) to incorporate system integrators and access point providers into the onboarding ecosystem. These providers are tasked with supporting the integration process and helping companies manage their transition onto the e-invoicing platform.

While the original deadline for onboarding was set for August 1, the tax agency has granted a three-month grace period to allow companies facing operational challenges to comply. The new deadline for mandatory integration is November 1, 2025.

“In the spirit of encouraging voluntary compliance, the FIRS management has graciously approved a three-month extension of the deadline,” the agency said. “We also acknowledge the genuine efforts of many taxpayers who strove to meet the 1st of August 2025 deadline but encountered operational constraints.”

The system will eventually be extended to medium and smaller enterprises, but for now, the focus remains on onboarding the largest players, who contribute a significant share of Nigeria’s corporate tax base.

Nigeria, Africa’s largest population, has been ramping up efforts to boost non-oil revenues amid volatile crude prices and growing fiscal pressures. Tax-to-GDP ratio remains among the lowest globally, estimated at just over 10%, according to official figures.

The FIRS has increasingly leaned on technology to expand the tax net and reduce leakages.

“The e-invoicing platform gives us real-time visibility into the business-to-business segment, which has historically been under-reported,” a senior FIRS official familiar with the rollout said, requesting anonymity because he was not authorized to speak publicly. “It significantly enhances our ability to track transactions and enforce compliance.”

To facilitate onboarding, the FIRS e-Invoicing Implementation Team is conducting webinars, workshops, and town hall sessions across the country, targeting tax consultants, financial controllers, and compliance officers within affected firms.

The Federal Government expects the digitisation effort to streamline tax administration, reduce disputes and simplify audit processes for both taxpayers and regulators.

The FIRS has not disclosed projected revenue gains from the e-invoicing rollout, but industry experts believe it could yield significant medium-term improvements in tax efficiency and administration.

Google has become the latest company to fall victim to cyber criminals increasingly using artificial intelligence (AI) to bypass security measures and trick users with highly-realistic documents that install malware on networks.

This Google attack, following a similar incident targeting Microsoft SharePoint servers globally, was confirmed earlier this week.

Google, one of the so-called “Magnificent Seven” US tech companies, revealed that one of its corporate Salesforce instances was compromised by a financially-motivated threat cluster known as UNC6040.

AI is rapidly becoming hackers’ tool of choice for crafting convincing e-mails and phone calls that mimic familiar voices or sound authentically human. E-mails often include attachments that appear legitimate, prompting recipients to click and unwittingly allow malware to infiltrate networks. Meanwhile, phone calls push targets to click links sent via SMS or WhatsApp.

Richard Cassidy, Europe, Middle East and Africa chief information security officer at Rubrik, says: “We are definitely seeing these incidents become more prevalent. What’s driving this surge is a combination of rapidly-evolving AI-enabled attack tools, and the ever-expanding attack surfaces created by widespread digitalisation, without proportional investment in cyber resilience.”

The UNC6040 group targets Salesforce environments by impersonating IT support to deceive employees into installing malicious connected apps, often disguised as Salesforce’s Data Loader. This enables the attackers to covertly access networks and extract sensitive data.

Quick response

In the most recent attack, Google said it “responded to the activity, performed an impact analysis and began mitigations”. The breach affected systems storing contact information and related notes for small and medium businesses.

“Analysis revealed that data was retrieved by the threat actor during a small window before access was cut off. The data retrieved was confined to basic and largely publicly available business information, such as business names and contact details,” Google said.

Google also reported that the extortion involved calls or e-mails to victim organisation employees demanding Bitcoin payments within 72 hours. During these communications, the threat actors have consistently claimed to be the group known as ShinyHunters.

Large-scale attacks

SentinelLABS and Beazley Security recently uncovered and analysed a rapidly-evolving series of infostealer campaigns delivering the Python-based PXA Stealer. This malware uses Telegram bots to sell stolen data in a manner that is nearly undetectable.

The actors, reportedly Vietnamese hackers, have compromised more than 4 000 unique victim IP addresses across at least 62 countries, including South Korea, the United States, the Netherlands, Hungary and Austria.