The Corporate Affairs Commission has rolled out a major security upgrade to its Integrated Company Registration Portal, requiring all users to reset their passwords and activate Two-Factor Authentication before gaining access a mandatory overhaul that comes just days after the commission confirmed a cybersecurity incident involving unauthorised access to limited aspects of its information systems.
The commission announced the new requirements on its official X handle on Monday, describing the update as part of efforts to strengthen data protection and reduce unauthorised access following recent system maintenance a characterisation that notably avoids direct reference to the cybersecurity breach disclosed on April 15, but whose timing leaves no doubt about the connection.
Under the new security regime, the simple act of logging into the CAC portal to register a company, file annual returns, or access corporate records now requires a two-step verification process involving a new password and a time-based authentication code generated by the Google Authenticator mobile application replacing the simpler email-based verification methods previously used and bringing the portal’s security architecture closer to international standards for systems handling sensitive business data.
The CAC has outlined a detailed step-by-step process that all portal users must complete before regaining access to their accounts.
First, users must visit the official iCRP portal at https://icrp.cac.gov.ng/ and initiate a password reset by clicking the “Forgot Password” or “Reset Password” link on the login page. They must enter the email address or username linked to their account and submit the request. A reset link will be sent to the registered email address, through which users can create a new, stronger password.
The commission has emphasised that this initial password reset is required only once but it is mandatory. Users cannot access their accounts using their old passwords.
Second, after resetting their password, users must log back into the portal using their new credentials. The system will then prompt them to enable Two-Factor Authentication.
To complete the 2FA setup, users must download the Google Authenticator app available on both the Apple App Store and Google Play Store if they do not already have it installed. The portal will display a QR code, which users must scan using the Google Authenticator app to add their iCRP account.
Once scanned, the app will begin generating six-digit authentication codes that change every 30 seconds. Users must enter the current six-digit code from the app into the portal to complete the setup.
For all future logins, users will need to enter their email or username, their new password, and the current six-digit code from the Google Authenticator app — a three-layer authentication process that significantly increases the difficulty of unauthorised access.
While the CAC described the update as part of routine efforts to strengthen data protection, the timing is unmistakable.
On April 15, 2026 just six days before Monday’s announcement the commission issued a public notice confirming that it was “currently reviewing a cybersecurity incident involving unauthorised access to limited aspects of its information systems.”
That notice advised stakeholders to “monitor their records on the CAC portal, update login credentials, and remain cautious of unsolicited communications” the very actions that Monday’s mandatory security upgrade now enforces.
The progression from advisory to mandatory requirement suggests the commission’s assessment of the breach has determined that voluntary credential updates were insufficient and that a forced reset of all passwords, combined with the introduction of a significantly more robust authentication mechanism, was necessary to secure the portal against further unauthorised access.
The switch from email-based One-Time Password verification to app-based Two-Factor Authentication is particularly telling. Email-based OTP systems are vulnerable to email account compromises if the cybersecurity incident involved access to users’ email addresses stored in the CAC’s systems, an attacker could potentially intercept email-based verification codes. App-based 2FA, which generates codes locally on the user’s device without transmitting them over email, eliminates this vulnerability.
The mandatory security upgrade affects every user of the CAC’s Integrated Company Registration Portal a population that includes company secretaries, lawyers, accountants, business owners, corporate registrars, and other professionals who interact with Nigeria’s corporate registry.
Given the CAC’s role as the sole authority for company registration, business name registration, incorporated trustees, and other entity types in Nigeria, the portal serves millions of registered entities and their authorised representatives. The mandatory password reset and 2FA activation therefore represents one of the largest forced security upgrades of a government digital platform in Nigeria’s history.
The process will inevitably cause temporary disruption as users navigate the new requirements particularly for less tech-savvy users who may be unfamiliar with authentication apps. The CAC has attempted to mitigate this by providing demonstration videos on its portal, official website, and social media platforms.
The shift from email-based verification to app-based Two-Factor Authentication represents a significant improvement in the portal’s security posture.
Email-based OTP systems, while better than password-only access, have well-documented vulnerabilities. If an attacker gains access to a user’s email account through phishing, credential stuffing, or data breaches they can intercept the OTP and bypass the second authentication factor.