Lawyers Without Borders Blasts CAC Over ‘Cover-Up’ of Massive Data Breach; Exposes Compromise of Signatures and Passports as NDPC Launches Investigation

The reality of Nigeria’s digital infrastructure has been laid bare as Lawyers Without Borders (ASF France) publicly challenged the Corporate Affairs Commission over its handling of a severe cyberattack. Today, April 21, 2026, the group issued a stinging statement accusing the CAC of trying to “tinker” with the truth by hiding a data breach behind the label of “scheduled maintenance.” The “Solution” to this “Tsunami” of missing personal data, the group argues, must include immediate transparency and a clear plan to protect the thousands of Nigerians whose private information including passports and signatures has been exposed.

The “Renewed Hope” for a fully digitized business registry is now overshadowed by fears of identity theft. According to ASF France, the breach, linked to a hacking group called “ByteToBreach,” is not just a technical error but a violation of the constitutional right to privacy. The group pointedly asked why the CAC has not fulfilled its legal obligation to notify the individuals whose personal files were stolen, noting that the commission’s silence has left many entrepreneurs in the “digital trenches” of uncertainty, unsure if their identity is still secure.

The Nigeria Data Protection Commission (NDPC) has signaled that it will not be taking this lightly. Under the leadership of Dr. Vincent Olutunji, the NDPC has launched a probe to review the CAC’s “Access Control Mechanisms” and “Vulnerability Assessment and Penetration Testing (VAPT)” protocols. As the government continues its ₦73 trillion economic push, the NDPC warned that threat actors are now using “sophisticated methods” to compromise interconnected government databases, making this CAC incident a massive test case for Nigeria’s data governance laws.

As the political cycle picks up speed, the message from the rights community is one of accountability. For the average Nigerian entrepreneur, today’s development is a grim reminder that their “sacred” data is not as safe as promised. While the authorities investigate the “what and how” of the breach, the call from Lawyers Without Borders is clear: the CAC must stop the “script” of quiet damage control and start protecting the citizens it is meant to serve.