By Dr. Agoye Olorunfemi
The recent cybersecurity incident at the Corporate Affairs Commission (CAC) is being treated, in many quarters, as just another breach, an unfortunate but isolated event in an increasingly digital world. It isn’t just an isolated event; it’s an indicator. And like any indicator, it needs to be understood, not ignored.
What we are witnessing is not a single failure, but a pattern that points to deeper structural vulnerabilities within Nigeria’s national information infrastructure.
Over the past few weeks, reports and disclosures have emerged involving cyber intrusions across a range of institutions, from financial entities such as Sterling Bank and Remita to government systems and academic institutions like Lagos State University. These are not random or disconnected events; they reflect an emerging and coordinated reality: Nigeria’s digital systems are being systematically probed, tested, and, in some cases, compromised.
The CAC incident is simply the most visible manifestation of a broader and more concerning trend.
Notably, the Commission itself acknowledged “unauthorised access to limited aspects of its information systems” in its April 15, 2026, notice, while confirming that response protocols had been activated in collaboration with the National Information Technology Development Agency (NITDA) and other stakeholders. This transparency is commendable. However, the substance of the disclosure underscores a more critical issue: even critical national systems are no longer immune to being compromised.
From a cybersecurity and national infrastructure protection perspective, the implications are clear: Nigeria’s attack surface has expanded dramatically, but the same can’t be said for its defensive posture. As systems become more interconnected, linking identity, banking, business registration, and public services, weaknesses in one area can ripple through others, creating systemic risks that are hard to contain once they start unfolding.
This goes beyond just a technical problem; it’s about trust in our digital systems. Citizens and businesses interact with platforms such as the CAC under the assumption that these systems are secure, resilient, and reliable. It may seem subtle, but it’s a core assumption, because once a breach occurs, particularly in critical institutions, they don’t just affect one system; they ripple out, eroding trust across the digital ecosystem. Over time, this erosion of trust can undermine adoption, discourage both local and foreign investment, and weaken the credibility of digital governance itself.
At the heart of the problem is a structural gap. Nigeria has multiple institutions with cybersecurity mandates, the National Information Technology Development Agency (NITDA), the Nigeria Data Protection Commission (NDPC), Nigeria Computer Emergency Response Team (NgCERT), and the Office of the National Security Adviser (ONSA), among others. Yet what is lacking is a unified operational framework that treats cybersecurity not merely as a regulatory function, but as a matter of coordinated national security execution.
The current model is fragmented with responsibilities distributed, but accountability is diffused. In practice, this means that incidents are often addressed in isolation, without a coordinated, real-time response mechanism that reflects the interconnected nature of modern digital systems.
Recent actions by NITDA reinforce this concern. In its joint position with the CAC, the agency directed all Ministries, Departments, and Agencies (MDAs) to immediately review and reinforce their cybersecurity architecture in line with the National Cybersecurity Policy and Strategy 2021. While necessary, such directives highlight a recurring pattern in Nigeria’s cybersecurity posture: a strong emphasis on compliance and remediation after exposure, rather than continuous, intelligence-led defense before compromise.
The federal government’s proposal to establish a Cybersecurity Coordination Council is a welcome step. It signals recognition at the highest levels that the threat landscape has evolved and that a more structured response is required. However, coordination structures without operational clarity risk becoming advisory platforms rather than active defensive capabilities. The challenge is not simply to convene stakeholders, but to define how they act together, decisively, and in real time when incidents occur.
Three priorities stand out.
First, Nigeria must clearly define and rigorously protect its Critical National Information Infrastructure (CNII). Systems such as corporate registries, financial transaction platforms, identity databases, and telecommunications backbones are not just administrative tools; they are strategic national assets. Their compromise carries implications for economic stability, investor confidence, and national security. They must be formally classified, continuously monitored, and secured with standards commensurate with their importance.
Second, the country must move beyond compliance-driven cybersecurity toward resilience-driven security. Regulatory frameworks, audits, and baseline controls are necessary, but they are no longer sufficient in isolation. What is needed is a shift toward proactive threat intelligence, continuous monitoring, simulated attacks, and robust incident response capabilities that can detect, contain, and recover from attacks in real time.
Third, there is an urgent need for a centralized cyber incident command structure. In more mature digital economies, significant cyber incidents trigger coordinated national responses led by clearly designated authorities with operational control. In Nigeria, they often trigger investigations, important but inherently reactive. Without a command structure capable of orchestrating a unified response across sectors, the country remains exposed to fragmented, delayed, and suboptimal reactions.
Underlying all of this is a broader imperative: to treat digital trust as a strategic national asset. Trust is not abstract; it is measurable in user behavior, investor sentiment, and institutional credibility. It is the foundation upon which digital economies are built. Without it, even the most sophisticated platforms will struggle to achieve adoption or deliver meaningful value.
Building and sustaining that trust requires more than technical fixes. It requires institutional alignment, policy coherence, and a sustained commitment to transparency, accountability, and rapid response.
Nigeria is no longer simply undergoing digitisation; it is moving into a state of digital dependence. Government services, financial systems, academic operations, and business ecosystems are increasingly anchored in digital platforms. This dependence brings efficiency, scale, and opportunity. But it also introduces new forms of systemic risk, risks that if left unmanaged, can undermine the very gains that digitisation promises. And as we know, dependence without resilience is vulnerability.
The CAC incident should not be treated as an anomaly to be investigated and closed. It should be recognised for what it is: a warning signal. A prompt to reassess the country’s cybersecurity architecture, to confront its structural weaknesses, and to act with urgency before more consequential disruptions occur.
The question is no longer whether cyber incidents will happen; they will. The real question is whether Nigeria’s national systems are designed to withstand them.
At present, the answer remains uncertain, and that uncertainty is itself a risk Nigeria can no longer afford to ignore.
Dr. Agoye Olorunfemi is a technology strategist and cybersecurity consultant with a PhD in Computer Science (Cybersecurity). He leads CyberNexus Technologies and works at the intersection of digital trust, National Information Infrastructure Protection (NIIP), leadership, and governance.
