In the last three weeks, a single threat actor has walked through Nigeria’s banking sector, its federal payment rails, and its national business registry — and walked out with roughly three terabytes of data. The attacker, who goes by ByteToBreach, did not use zero-day exploits or nation-state tooling. They used an unpatched test server, production credentials left in a public-facing Git repository, and an API endpoint that counted upward through integer user IDs.
This is not a hypothetical. The data is already published. And as of this week, Nigeria’s data protection regulator has three open investigations, the Corporate Affairs Commission has formally admitted the breach, and Lagos State has hurriedly issued new cybersecurity guidelines. Here is what happened, what it means, and why it matters far beyond the three institutions involved.
What makes the ByteToBreach campaign different from the ransomware headlines Nigeria has grown used to is that it was not three separate attacks. It was one chain.
ByteToBreach’s entry point into Nigeria’s financial system was an internet-facing test server belonging to Sterling Bank. The server carried an unpatched vulnerability that had been publicly known — and publicly exploitable — for three months before the breach. No phishing was needed. No insider was required. The front door was propped open.
From that foothold, the attacker moved deeper into Sterling’s internal infrastructure, eventually extracting KYC documents, transaction logs, internal source code, API keys, and password hashes. As proof, the attacker publicly released the personal details, home address, and transactions of the bank’s Managing Director.
Remita is not just a payment processor. It is a critical artery of the Nigerian federal government — the platform that handles the Treasury Single Account, salary payments for federal workers, and revenue collection for multiple MDAs.
ByteToBreach did not break into Remita from the outside. They reached it through Sterling Bank’s network, which Remita trusted. Once inside, they discovered something that should not have existed in 2026: production database credentials stored in plaintext inside a Git repository configuration file.
The result: terabytes of KYC records, financial statements, and system backups extracted from a platform that sits underneath the Nigerian federal budget.
If Sterling and Remita were the financial arteries, the Corporate Affairs Commission (CAC) is the economy’s address book. Every registered company in Nigeria — from startups to multinationals — lives in its database, along with the directors, shareholders, addresses, dates of birth, passport numbers, and NIN numbers associated with them.
The CAC breach was almost embarrassingly simple. The authentication system at authapp.cac.gov.ng generated JWT tokens via an endpoint that accepted an integer user ID (/api/v1/back_office/jwt/{userId}) — with no password, no second factor, and no rate limiting. ByteToBreach iterated upward through the integers until the system returned a valid staff token for user 4705317.
From there, they created a staff account literally named bytetobreach with 474 administrative roles and pivoted to the CAC’s document management system (edmsapp.cac.gov.ng), where — in the attacker’s own words — “no login, no token, no credentials” were required. If you knew the filename, you could download the file.
The attacker initially claimed roughly 25 million CAC documents. Later, they stated the real number “could be much higher.” The publicly available archives total 759.2 GB across four compressed files.
ByteToBreach has claimed they contacted all three victim organisations before publishing any data. Two ignored the outreach. Sterling Bank reportedly engaged, with a discussed ransom of €250,000, then — according to the attacker — “kept postponing indefinitely.” The data was published regardless.
When asked whether ordinary Nigerians whose identity documents are now circulating on cybercrime forums deserved any consideration, the attacker responded plainly:
“Protecting Nigerians is not my responsibility. That’s the duty of the government.”
That answer, uncomfortable as it is, points at the real story here.
It would be convenient to treat Sterling, Remita, and CAC as three separate organisations with three separate failures. They are not. Each breach exposed a class of vulnerability that is endemic across Nigerian enterprises:
The ByteToBreach campaign is the loudest story of April 2026, but it is not the only one.
lnrbda.gov.ng), exfiltrating project records, employee files, and internal communications.Nigeria’s regulators are moving, though the pace is being dictated by breaches rather than strategy.
If you run an organisation in Nigeria — whether a fintech, a traditional bank, a government agency, or an SME — the ByteToBreach campaign is a rehearsal for what is coming. Five questions worth answering this week:
The uncomfortable truth of the ByteToBreach campaign is that none of the vulnerabilities exploited were novel. Unpatched servers, secrets in Git, IDOR, and implicit trust are cybersecurity 101 — and they took down three of Nigeria’s most important institutions in a matter of weeks. The organisations that will weather 2026 are not the ones with the biggest security budgets. They are the ones who take the basics seriously, test them honestly, and assume they are already targets.
Because as ByteToBreach put it, protecting Nigerians is a responsibility that someone has to take — and so far, too few organisations have stepped forward.
Every single failure that enabled the ByteToBreach campaign is one we test for — or help clients eliminate — on standard engagements. Here is how each failure in this story maps directly to work we do for organisations across Nigeria, the US, and the UK:
| The failure that enabled the breach | How 6030 Technologies addresses it |
|---|---|
| Sterling Bank’s internet-facing test server, unpatched and forgotten for three months | External Attack Surface Discovery — We enumerate every internet-facing asset you own, including the test, staging, demo, and legacy environments your current inventory misses, and prioritize them by exploitability. |
| Remita’s production credentials sitting in a plaintext Git config file | Source Code & Secrets Audit — We scan current and historical commits across every branch and fork for credentials, tokens, and keys before a threat actor finds them. |
| CAC’s JWT endpoint accepting sequential integer user IDs with no password or rate limit | Application & API Penetration Testing — Our testers chain findings the way real attackers do, catching the IDOR, broken access control, and authorization-bypass flaws that automated scanners miss. |
| Lateral movement from Sterling into Remita via implicit inter-organisational trust | Network Segmentation & Zero-Trust Architecture Review — We assess the trust boundaries between your systems, partners, and suppliers, and design segmentation that contains a single compromise. |
| Three institutions learning they were breached from cybercrime forums, not from their own logs | Security Monitoring & Managed Detection — So the first indication of compromise is an alert in your SOC, not a screenshot on a Telegram channel. |
| Sterling Bank’s stalled €250,000 ransom negotiation with no clear playbook | Incident Response Retainers — A pre-agreed playbook, pre-engaged responders, and a defined communications path so the 24 hours after a breach do not define the next 24 months. |
| Open NDPC investigations and an April 2026 advisory demanding MFA, zero-trust, DPOs, and DPIAs | NDPA Compliance & DPO Services — Gap assessments, certified DPO advisory, DPIAs, and remediation planning aligned to the Nigeria Data Protection Act 2023. |
If any of the five questions earlier in this article gave you pause, we would like to help you answer them. We offer a free 45-minute consultation with a senior 6030 consultant. We will review your current posture, identify your two or three highest-risk exposures right now, and give you a prioritized, vendor-neutral remediation roadmap — at no cost, no obligation.
Book your security review by emailing us at info@6030technologies.com.
6030 Technologies provides cybersecurity services including penetration testing, security assessments, NDPA compliance support, and continuous monitoring for organisations in Nigeria, the US, and the UK. This brief is part of an ongoing series tracking cyber threats to Nigerian entities. Interested in knowing how we can help you? Reach out by Contacting Us.
Our team can help you assess and mitigate security risks specific to your business.