Nigeria’s Corporate Affairs Commission hit by cyberattack as investigation begins

Nigeria’s Corporate Affairs Commission (CAC), the government agency responsible for business registration and corporate records, has suffered a cyberattack that disrupted parts of its digital infrastructure and prompted a formal investigation.

The breach has sparked concern across Nigeria’s business and technology sectors, given the CAC’s crucial role in company formation, regulatory filings and access to verified corporate information. The commission manages millions of records, including business ownership details, incorporation documents and compliance histories, making the incident a potentially significant data security issue.

Early reports indicate that sections of the CAC’s online platform were affected, leading to temporary restrictions on some digital services. Users attempting to access registration and filing portals experienced downtime and delays as the agency moved to contain the breach and prevent further unauthorised access.

The Corporate Affairs Commission is now working with the National Information Technology Development Agency (NITDA) and other cybersecurity stakeholders to determine the full scale of the incident. At the time of reporting, officials had not confirmed whether sensitive information was accessed or extracted, but investigations remain ongoing.

The Nigeria Data Protection Commission (NDPC) is also monitoring developments because of possible implications for personal and corporate data privacy. Concerns include potential unauthorised access to directors’ information, shareholder records and company compliance submissions held within CAC databases.

The attack comes as Nigeria continues to digitise public services in a broader effort to improve efficiency and transparency. In recent years, the CAC has expanded its online systems to make business registration faster and more accessible, reducing reliance on physical paperwork and in-person processes.

However, the rapid shift towards digital governance has also increased exposure to cyber threats targeting public institutions. Cybersecurity experts note that government databases hold highly valuable information, making them attractive targets for ransomware operators, fraud syndicates and state-backed actors.

Analysts say the breach highlights the urgent need for stronger cyber protection frameworks across Nigeria’s public digital infrastructure. While agencies such as NITDA have introduced cybersecurity standards and guidelines, enforcement and continuous system monitoring remain critical challenges.

For businesses, even a short-term disruption could have serious consequences. As the CAC underpins corporate legitimacy in Nigeria, service interruptions may affect company verification, investor due diligence, banking compliance checks and legal documentation processes.

Start-ups and small businesses that depend on swift registration services may also face setbacks if recovery efforts are prolonged or if some services remain suspended during forensic investigations.

Beyond the immediate operational impact, the cyberattack raises wider concerns about confidence in Nigeria’s digital governance systems. As more government agencies move essential services online, expectations around data security, system reliability and cyber resilience are becoming increasingly important.

The incident may also carry regulatory implications. Under Nigeria’s data protection laws, institutions managing sensitive personal and corporate information are required to maintain adequate safeguards. Should investigations reveal negligence or exploitable vulnerabilities, the CAC could face further compliance scrutiny.

For now, authorities are focused on restoring full functionality, assessing the extent of the damage and identifying the source of the attack. Whether the breach was financially motivated, politically driven or opportunistic remains unclear.

What is increasingly evident, however, is that as Nigeria’s digital economy expands, so too does its vulnerability to cyber threats. The CAC cyberattack serves as a stark reminder of the mounting pressure on public sector digital infrastructure and the growing importance of robust cybersecurity reforms.