The Corporate Affairs Commission (CAC) has launched an investigation into a cybersecurity incident involving unauthorised access to parts of its information systems, raising concerns over the security of Nigeria’s corporate registry platform.

In a statement seen by Technology Times, the Commission confirms that the breach affected “limited aspects” of its systems, prompting the immediate activation of its internal response protocols.

“The Corporate Affairs Commission (CAC) is currently reviewing a cybersecurity incident involving unauthorised access to limited aspects of its information systems,” the agency says.

In a statement seen by Technology Times, the Commission confirms that the breach affected “limited aspects” of its systems, prompting the immediate activation of its internal response protocols.

CAC activates response, works with NITDA

The Commission says it is working with the National Information Technology Development Agency (NITDA), alongside other relevant government agencies and partners, to assess the scope and potential impact of the incident.

“The Commission promptly activated its response protocols and is working with National Information Technology Development Agency (NITDA), relevant government agencies and partners to assess the scope and impact,” CAC says.

Containment measures have already been implemented, the agency says, with additional safeguards deployed to strengthen system security while the review continues.

“Appropriate containment measures have been implemented, and additional safeguards are in place,” the Commission adds.

Users advised to take precautionary steps

While the full extent of the breach remains under review, CAC is advising users of its portal to take precautionary measures, including monitoring their records, updating login credentials and remaining vigilant against unsolicited communications.

“Stakeholders are advised to monitor their records on the CAC portal, update login credentials, and remain cautious of unsolicited communications,” the agency says.

The advisory highlights risks linked to phishing and social engineering attacks, where threat actors exploit security incidents to obtain sensitive information through fraudulent emails and messages disguised as official communication.

CAC corporate registry integrity in focus

CAC maintains that it remains committed to safeguarding the integrity of Nigeria’s business registration database, which holds critical records such as company registration details, directors’ information and shareholding structures used for compliance and verification.

For businesses, financial institutions and investors, CAC data underpins Know Your Customer (KYC) checks, due diligence processes and regulatory filings. Any disruption or perceived vulnerability, even if limited, could raise concerns around data reliability and trust in corporate records.

The incident also brings renewed attention to Nigeria’s cybersecurity and data protection framework, particularly as public institutions continue to digitise essential services.

As the country’s IT regulator, NITDA plays a central role in coordinating responses to cyber incidents and enforcing compliance with national data protection and cybersecurity policies.

Globally, cyberattacks targeting government databases and corporate registries are becoming more frequent, reflecting the high value of the economic and identity data they contain.

Investigation ongoing, CAC says

Although CAC says the breach has been contained, the ongoing investigation is expected to determine whether any sensitive corporate data was compromised and identify additional measures required to prevent future incidents.

“CAC remains committed to the security and integrity of Nigeria’s corporate registry and will provide updates as necessary,” the Commission says.