The Corporate Affairs Commission (CAC) has flagged a security breach involving unauthorised access to parts of its systems and urged users to update their login credentials as a precaution.
The disclosure was made on April 15, 2026, in a public notice issued by the Commission’s management, where it informed stakeholders of an ongoing review of the incident affecting aspects of its information systems.
The Commission said it had activated its response protocols and is collaborating with the National Information Technology Development Agency (NITDA), alongside other relevant government agencies and partners, to assess the scope and impact of the breach.
What CAC is saying
CAC said it is currently reviewing a cybersecurity incident involving unauthorised access to limited parts of its information systems. It added that it had activated response measures and is working with NITDA and other partners to evaluate the extent of the breach.
- “Appropriate containment measures have been implemented, and additional safeguards are in place,” the Commission said.
It also advised stakeholders to monitor their records on the CAC portal, update login credentials, and remain cautious of unsolicited communications.
- “While the review is ongoing, stakeholders are advised to monitor their records on the CAC portal, update login credentials, and remain cautious of unsolicited communications.”
Get up to speed
According to Dark Web Informer, an anonymous X account that claims to track global cybercrime, about 25 million documents were allegedly exfiltrated from CAC’s infrastructure.
- Although Nairametrics could not independently verify who is behind the attack, and CAC has not confirmed the claim, Dark Web Informer alleged that the threat actor is ByteToBreach.
CAC, however, reiterated its commitment to the security and integrity of Nigeria’s corporate registry and said it will provide updates as necessary.
What you should know
The Corporate Affairs Commission is Nigeria’s primary regulator responsible for the registration and management of companies, business names, and incorporated trustees, serving as the custodian of the country’s corporate registry.
- In February 2026, the Commission disclosed that it processes up to 10,000 business registration requests daily following the deployment of artificial intelligence across its service delivery platforms.
- According to the Registrar-General, Hussaini Magaji, the system also handles an average of 5,000 customer inquiries daily through emails and call centres.
Nairametrics previously reported that the CAC deregistered over 400,000 companies in 2025 due to prolonged inactivity and non-compliance with statutory requirements.
