This opening scene is a composite, not a reported case.
A grants officer at a funding organization receives a letter from a rights group in Lagos that they have proudly supported for two years. The letter, printed on the exact company letterhead and bearing the Director’s signature, requests that their upcoming payment be routed to their new bank account. To ensure a seamless transition, they attach their CAC certificate, ID page of the director, and a recent status report.
She checks the certificate and signature. Everything matches perfectly, so the change is approved.
Three weeks later, the actual program lead of the rights group calls to ask about the delayed installment. The letter was never written or sent by the director. All the documents were authentic, but they had been stolen and repurposed by someone else.
What happened in April
This scenario is not just a paranoid hypothetical. On April 15, the Corporate Affairs Commission (CAC) confirmed unauthorized access to parts of its systems. On the same day, a threat actor calling itself ByteToBreach claimed to have stolen approximately 25 million documents, roughly 750 gigabytes of data.
Press reports based on the group’s claims suggest more than 15 million of these are significant, including ownership information, directors’ IDs, and signatures. While the CAC stated it was a “limited breach” and an investigation is underway with the Nigeria Data Protection Commission, they have not confirmed exactly how much was taken.
What Changes for Verification?
The CAC holds the records of all companies, business names, and incorporated trustees in Nigeria. We have not seen reports that the core register itself was altered. However, the CAC documents can no longer be used as standalone evidence of identity. Previously, a certificate, signature, and director’s ID were sufficient proof that the person submitting them was authorized by the organization. With these documents potentially in circulation, a malicious actor outside the organization could easily hold pristine copies.
For civil society, there is a severe secondary risk: Directors’ identity documents belong to individuals, many of whom work in front-line human rights settings where being identifiable carries immense physical and political risk.
If your organization is registered with the CAC:
- 1. Audit your portal: Update your login details for the CAC portal and check your records for any unauthorized changes.
- 2. Establish a payment policy: Agree with your funders and partners on a strict protocol. Any changes to bank details must be confirmed by calling a trusted, pre-existing phone number and approved by two internal stakeholders.
- 3. Protect your directors: Your directors’ IDs and signatures may already be in circulation. They must remain highly vigilant against any attempts to open accounts, take out loans, or sign agreements in their names.
If you fund, contract, or subgrant:
- 1. Verify via secondary channels: Contact the organization through a secure, pre-existing channel and ask a question only the real organization would know. If you cannot get in touch, halt the payment.
- 2. Redesign your vetting: Identify everywhere CAC documents are used in your process (onboarding, grantee vetting, partner agreements) and mandate additional verification steps, such as a video callback or references from a common contact.
- 3. Flag behavioral anomalies: Pay extremely close attention to sudden changes, new bank details, unrecognized contact numbers, or unusual pressure for “fast” or “urgent” payments.
Beyond Nigeria
Registries in other countries hold comparable records. CSOs elsewhere can ask their own registrar what data it holds about their organisation and directors, how that data is protected, and how the registrar would notify them of an incident.
Where to Start:
While the national investigation remains open, adopting a “trust but verify” rule, where human callbacks supersede document checks, gives you immediate protection that doesn’t rely on compromised paper trails.
At Resilience Technologies Africa, we help organizations close these exact operational gaps. We offer a free, confidential 10-minute Digital Resilience Assessment that provides you with a custom vulnerability report across 18 key areas and actionable next steps to secure your workflows.