Reach More Customers
Promote Your Business Online Today
ABUJA, FCT ― By Prime Brief Media
Hackers have stolen and leaked more than 15 million sensitive company documents from Nigeria’s Corporate Affairs Commission, in what cybersecurity experts are describing as the most consequential breach of Nigeria‘s digital infrastructure to date.
The ransomware group known as ByteToBreach carried out the attack, exfiltrating approximately 25 million files totalling roughly 750 gigabytes of data from the commission’s systems. The group posted proof of the breach online, including seven screenshots that document every stage of the hack from initial system access to complete administrative control. One screenshot was labelled “GOV_BETRAYAL,” appearing to mock the Nigerian government‘s inability to protect sensitive national data.
The CAC is Nigeria’s official registry for every company, business name, and incorporated trustee in the country. Its database holds legal identities, ownership details, directors‘ information, and company structures. Experts say more than 15 million of the leaked files contain detailed, high-value information, not just basic records. These files include beneficial ownership records, which show who really owns and controls each company.
The breach has dealt a severe blow to Nigeria’s anti-money laundering reforms. For years, Nigeria has faced strong international pressure to stop the use of shell companies for hiding illicit funds, corruption proceeds, and financial crimes. The CAC, under Registrar-General Hussaini Magaji, had been leading major reforms and recently handed over 248 suspected fake company registrations to the Economic and Financial Crimes Commission with a promise of greater transparency.
The goal was to build a clean beneficial ownership database so banks, courts, and investigators could easily verify who truly controls a business. The breach has now significantly undermined that progress. Fraudsters now possess what experts describe as a master key to Nigeria‘s entire formal economy. They can see exactly how both legitimate and fake companies are structured, making it easier to create convincing shell companies, commit identity theft, blackmail directors, or divert funds through fake invoices.
A system security expert, DeMayor, explained the gravity of the situation: “When a bank conducts due diligence on a corporate client, it checks the CAC. When a court needs to establish legal ownership of a company, or when the EFCC investigates fraud or a contract dispute, they rely on this same register.” With that system now compromised, the integrity of these processes faces serious risk.
The CAC confirmed the cybersecurity incident on April 15, 2026, stating that it involved unauthorized access to limited aspects of its information systems. The commission said it had activated response protocols and was collaborating with the National Information Technology Development Agency and other relevant government partners to assess the scope and impact of the breach. Containment measures were implemented, and additional safeguards put in place.
The CAC portal was taken offline for scheduled maintenance from April 17 to April 20, 2026, with operations resuming at 6:00 a.m. on Monday.
The Nigeria Data Protection Commission has opened a full investigation into the breach under Section 46(3) of the Nigeria Data Protection Act, 2023. Lawyers Without Borders France has alleged that the breach led to the compromise of sensitive personal data, including handwritten signatures, national identity documents, and passport photographs.
The CAC breach is part of a wider pattern of attacks targeting Nigeria‘s critical digital systems. In recent weeks, the same group claimed access to 900,000 customer accounts at Sterling Bank and breached Remita, a key government payment platform that handles salaries, taxes, and payments for the entire government.
Prime Brief Media continues to monitor the ongoing investigation and will provide updates as more information becomes available regarding the full extent of the data compromise and the regulatory response. Stakeholders are advised to monitor their records on the CAC portal, update login credentials, and remain cautious of unsolicited communications.
Post a Comment