The NDPC explained that its technical assessment indicates that some shadowy threat actors have engaged in coordinated operations targeting financial systems and some key digital infrastructure in Nigeria.
The Nigeria Data Protection Commission (NDPC) says it has commenced an investigation into the alleged breach of information systems at the Corporate Affairs Commission (CAC), issuing a regulatory advisory to counter the escalating threats to data security infrastructure.
“The Corporate Affairs Commission (CAC) is currently reviewing a cybersecurity incident involving unauthorised access to limited aspects of its information systems,” the CAC stated.
In a statement signed by Babatunde Bamigboye, NDPC Head, Legal, Enforcement and Regulations, on Friday, the commission responded to the alleged data breaches.
The NDPC also raised concerns that threat actors in the digital space have devised malicious methods of compromising the data security architecture of key databases.
Earlier in April, PREMIUM TIMES reported that the NDPC’s investigation into an alleged data breach involving Remita Payment Services Limited, Sterling Bank, and other entities.
In its statement on Friday, the commission added that recent digital threats involve large-scale data exfiltration and cross-platform compromise across interconnected systems.
“Pursuant to Section 46(3) of the Nigeria Data Protection Act, 2023 (NDP Act), the Nigeria Data Protection Commission (NDPC) has initiated an investigation into the reported data breach at the Corporate Affairs Commission (CAC).
“This investigation underscores the importance of fostering trust in Nigeria’s economic environment. The NDPC notes with concern that threat actors in the digital space have devised malicious methods of compromising the data security architecture of key databases,” the NDPC stated.
As part of a continuum of regulatory support measures, the commission said it is urgently interfacing with relevant authorities and pivotal organisations, with a view to reinforcing existing guardrails for the processing of personal data.
“The investigation of the instant case will, inter alia, cover the procedures and outcomes of Access Control Mechanisms, Data Privacy Impact Assessments, Vulnerability Assessment and Penetration Testing (VAPT), as well as due diligence on third-party data processors,” the statement noted.
The NDPC also assured Nigerians that frameworks for data protection, in terms of technology and other requisite resources in Nigeria, remain fundamentally strong.
“This is evident in the increasing rate of access to data-driven services,” the commission stated.
In a separate statement issued on Friday, the NDPC also released a regulatory advisory to all data controllers and data processors in response to the escalating threat to data security infrastructure.
The NDPC explained that its technical assessment indicates that some shadowy threat actors have engaged in coordinated operations targeting financial systems and some key digital infrastructure in Nigeria.
“Public establishments are therefore reminded of the Presidential Directive of His Excellency, President Bola Ahmed Tinubu, GCFR, declaring that data is the new oil, its value increases the more it is refined and responsibly shared.
“I therefore direct all ministries, extra-ministerial departments, and agencies to capture information rigorously and safeguard it under the Nigeria Data Protection Act 2023,” Mr Bamigboye stated, advising data controllers and processors on data security architecture.
The commission also charged the data controllers and processors (including MDAs) to step up their technical and organisational measures to ensure the privacy of all Nigerians and other data subjects in line with the Nigeria Protection Act, 2023 (NDP Act).
The advisory measures issued by the NDPC include appointment of duly trained and certified Data Protection Officers; development and effectual implementation of privacy policies and information security standards; carrying out Data Privacy Impact Assessments; deployment of robust identity and access controls, including Multi-Factor Authentication (MFA); and implementation of zero-trust security architecture and network segmentation.
Other measures include immediate remediation of identified system vulnerabilities and continuous patch management; securing cloud infrastructure, APIs, databases, and access credentials; implementation of real-time monitoring, logging, and threat detection mechanisms; implementation of encryption, key management, and secure credential handling; conduct of Vulnerability Assessment and Penetration Testing (VAPT) on critical systems; and regular backup, recovery, and resilience testing.
The commission added that it is also prepared to provide the requisite regulatory support to organisations to ensure an adequate level of data privacy and protection.
The NDPC, however, warned that organisations that fail or neglect to implement appropriate measures as required under the Nigeria Data Protection Act, 2023, will incur legal liabilities.
“Organisations that fail or neglect to implement appropriate measures as required under the Nigeria Data Protection Act, 2023, may incur legal liabilities.
“The Commission remains committed to protecting personal data, strengthening institutional resilience, and ensuring compliance across all sectors,” the commission stated.
