News

NDPC Investigates Alleged Data Breach at CAC

Ikeh James Certified Data Protection Officer (CDPO) | NDPC-Accredited April 17, 2026

NDPC partners with Civil Society Organisations

Nigeria’s data protection landscape is facing another major test in 2026 as the Nigeria Data Protection Commission (NDPC) launches a formal investigation into an alleged data breach at the Corporate Affairs Commission (CAC).

This development is not just another cybersecurity incident. It signals a deeper shift in how regulators are enforcing the Nigeria Data Protection Act (NDPA), holding institutions accountable, and protecting millions of Nigerians whose data sits in critical national databases.

This article provides a full expert breakdown of the situation, what triggered the investigation, the potential risks, regulatory implications, and what individuals and businesses should do right now.

NDPC Launches Investigation into CAC Data Breach

On April 17, 2026, the NDPC confirmed that it has initiated an investigation into reports of a potential data breach involving the Corporate Affairs Commission.

The probe is being conducted under Section 46(3) of the Nigeria Data Protection Act, 2023, which empowers the Commission to investigate violations and enforce compliance.

According to official statements, the investigation aims to:

determine whether a breach actually occurred
assess the extent of any data compromise
evaluate CAC’s data protection controls
enforce regulatory actions where necessary

The NDPC emphasized that this move is critical to maintaining trust in Nigeria’s digital and economic systems.

What Allegedly Happened: Inside the CAC Data Breach Claims

Early reports suggest that cyber threat actors may have targeted CAC’s infrastructure, potentially gaining unauthorized access to sensitive records.

Some circulating claims indicate that up to 25 million corporate records could have been exposed, although this figure is still under investigation and not officially confirmed.

In response, CAC acknowledged that certain aspects of its systems were affected but described the impact as limited. The agency also:

activated internal incident response protocols
began working with cybersecurity partners
advised users to update login credentials
urged stakeholders to monitor their records

This cautious response reflects a standard breach containment strategy, but it also raises critical questions about the security of national databases.

Why This Case Is a Big Deal

This is not just about one agency. The CAC manages one of Nigeria’s most sensitive and interconnected data systems, including:

company registration records
director information
business ownership data
compliance filings

A breach here could have far-reaching implications for:

corporate identity theft
financial fraud
insider manipulation
reputational damage for businesses

The NDPC itself warned that modern cyberattacks now involve large-scale data exfiltration and cross-platform compromise, especially across interconnected systems.

What the NDPC Is Investigating (Critical Areas)

The NDPC has outlined key technical areas it will examine during the investigation:

Investigation Area	What It Means
Access Control Mechanisms	Who had access and how access was managed
Data Privacy Impact Assessments	Whether risks were identified before processing
Vulnerability Assessment and Penetration Testing (VAPT)	Whether systems were tested for weaknesses
Third-Party Processors	Risks from vendors and external systems

This aligns with global best practices seen under frameworks like GDPR, where regulators focus not just on breaches, but on preventability and accountability.

Case Study: Rising Data Breach Investigations in Nigeria

This CAC investigation is part of a broader enforcement trend.

In recent months, the NDPC has launched probes into:

Remita Payment Services
Sterling Bank
global platforms handling Nigerian user data

These cases indicate a clear shift from awareness to active enforcement.

Historically, regulators were slower to act. In 2026, the NDPC is moving aggressively, investigating both public and private sector organizations.

Expert Insight: What Likely Triggered the Investigation

From a data protection expert perspective, there are three likely triggers behind this probe:

1. Public Leak Signals

Many modern investigations start from:

ransomware leak sites
dark web listings
whistleblower disclosures

If CAC data appeared in any of these channels, it would trigger immediate regulatory attention.

2. Suspicious System Activity

Indicators such as:

unusual login patterns
data export anomalies
unauthorized API access

often signal deeper compromise.

3. Third-Party Weak Links

In many breaches globally, attackers exploit:

vendors
cloud providers
API integrations

The NDPC’s focus on third-party processors strongly suggests this angle is being examined.

What This Means for Nigerian Businesses

If your company is registered with CAC, this development directly affects you.

Potential Risks

exposure of company records
unauthorized changes to filings
phishing attacks using leaked data
impersonation of directors or businesses

Immediate Actions to Take

update CAC account passwords immediately
enable multi-factor authentication where possible
monitor company filings for unauthorized changes
watch for suspicious emails referencing CAC data
conduct internal data risk assessments

What This Means for Data Protection Compliance in Nigeria

This case reinforces a key reality:

Compliance is no longer optional in Nigeria’s digital economy.

Under the Nigeria Data Protection Act:

organizations must implement security safeguards
conduct DPIAs for high-risk processing
report breaches within required timelines
ensure accountability across data systems

Failure to comply can lead to:

heavy fines
regulatory sanctions
reputational damage

Security Lessons from the CAC Incident

This situation highlights critical lessons for both public and private sector organizations:

1. Interconnected Systems Increase Risk

The more systems are linked, the higher the exposure surface.

2. Prevention Is More Important Than Response

Regular VAPT and security audits are no longer optional.

3. Third-Party Risk Is a Major Threat

Many breaches originate outside the core organization.

4. Real-Time Monitoring Is Essential

Delayed detection often leads to larger data exposure.

FAQ: NDPC and CAC Data Breach

Is the CAC data breach confirmed?

As of now, the NDPC is investigating. The full extent of the breach has not yet been officially confirmed.

What data could be affected?

Potentially company registration records, director details, and corporate filings, though exact details are still under review.

What should CAC users do now?

Update passwords, monitor records, and stay alert for phishing attempts.

Can affected individuals take legal action?

Yes. Under the NDPA, data subjects have rights to seek redress if their personal data is compromised.

Is Nigeria’s data protection system weak?

No. The NDPC maintains that Nigeria’s data protection framework remains strong, but continuous improvements are necessary due to evolving cyber threats.