CAC confirms cybersecurity breach as hackers expose millions of company records

The Corporate Affairs Commission has confirmed unauthorised access to its database, affecting millions of registered Nigerian companies’ records. The breach, attributed to hacker group “ByteToBreach,” has raised serious questions about how well Nigeria’s government digital infrastructure can actually protect sensitive data.

CAC confirmed the incident in a statement on its X account, saying the breach affected “limited aspects” of its information systems. “The Corporate Affairs Commission is currently reviewing a cybersecurity incident involving unauthorised access to limited aspects of its information systems,” the statement read.

The commission said it activated its response protocols immediately, working with the National Information Technology Development Agency and other government agencies to figure out the scope. Additional safeguards have been deployed, CAC added.

NITDA has since launched a coordinated probe, directing ministries and agencies to tighten digital controls. But the breach has exposed the gap between Nigeria’s push for digitised government services and its ability to secure them.

CAC holds registration data for every registered business in Nigeria — directors’ names, addresses, shareholding structures, financial filings. A breach of this scale means all of that information is potentially in the hands of people who could use it for identity theft, corporate espionage, or targeted fraud.

Security analysts have noted that CAC’s AI-powered database, introduced to speed up business registrations, may have created new vulnerabilities the agency wasn’t ready to defend. The uncomfortable question is whether Nigeria’s digital government ambitions are running ahead of its security capacity.

Sources: Daily Post Nigeria, FIJ, Nairametrics, IT Edge News