Complete BPE website backups, about a gigabyte of files belonging to Nigeria's Bureau of Public Enterprises, sat in a public web folder that anyone could open and download, according to a report published on Wednesday by Techpoint Africa. The security researcher who found them says the archives held the live database password and the site's WordPress security keys, and that files with matching names are being advertised on a hacker forum.
The BPE is the federal agency that runs Nigeria's privatisation and commercialisation programme. It handles sensitive transactions involving state-owned companies, which is why a lapse on its website draws more attention than a typical misconfigured server.
By the time the story ran, the agency had removed the folder and the address returned a 404 error. It declined to comment when Techpoint Africa contacted it before publication.
What the BPE website backups contained
The exposure was found by Chris Nwobi, founder of Zend Cybersecurity Threat Labs. He told Techpoint Africa reporter Asukwo Oduo that he found three archive files in a folder on the BPE server that was publicly listed. No login was needed. One click started a download.
According to the report:
- The three files together came to about 1.024 GB and appeared to be full WordPress backups of the bpe.gov.ng site.
- Nwobi said the backups contained the site's live database credentials and its WordPress security keys.
- He downloaded the files only to confirm what they were, he said.
- On October 17, he checked again and all three archives were still available.
- On October 19, Techpoint Africa tested the folder itself without a password. Downloads started, and the reporters stopped them.
A WordPress backup of this kind usually holds the site's code and settings and often a copy of its database. A database can include user accounts, published content and anything visitors submitted through forms. Techpoint Africa was careful to say it did not confirm everything inside the BPE files, so the exact contents beyond the credentials Nwobi described are not public.
Listings on a hacker forum
The more worrying part of the report is what Nwobi says he saw elsewhere. He told Techpoint Africa that dark-web monitoring tools and at least one hacker-forum listing advertised archives labelled "BPE 2024/2025 Backup". The names, the 2025 dates and the descriptions, he said, matched the three files on the agency's server.
That does not prove someone bought the data. It does mean the agency has to assume the files left its control before the folder came down.
Why a database password matters more than a defaced homepage
Nigerian government websites have been hit before. In December 2024 the National Bureau of Statistics posted on X that its website "has been hacked" and told the public to disregard anything posted on it until it was restored. That kind of incident is visible and embarrassing, and it is usually fixed by rebuilding the site.
Leaked credentials are quieter and can do more damage. With a working database password and the site's security keys, an attacker could read the database and, as the Techpoint Africa report notes, potentially change it. Security keys in WordPress are used to sign login cookies, so a stolen set can also help someone impersonate a logged-in user until the keys are replaced.
Nwobi said he reported the problem to the BPE directly, to ngCERT, the national computer emergency response team, and to the Nigeria Data Protection Commission (NDPC).
What the agency still has to do
Deleting the folder closes the door. It does not undo whatever already walked through it. Nwobi's advice, as reported by Techpoint Africa, comes down to four steps:
- Revoke public access to the backup location, which appears to have been done.
- Turn off automatic directory listing on the web server so folders cannot be browsed.
- Treat every credential in the archives as compromised. "Rotate the database password, the admin logins, the API and mail keys," he said.
- Review the server's access logs to see who downloaded the files and when.
The last step is the one the public will want an answer on. Access logs are the only way to tell whether the archives were pulled by one researcher and one newsroom, or by many more people.
The data protection question
If the database held personal information, the incident could fall under the Nigeria Data Protection Act 2023. Under the Act and the NDPC's General Application and Implementation Directive, a data controller has to notify the commission within 72 hours of becoming aware of a personal data breach, and must tell affected people directly where the breach is likely to put their rights at high risk.
Fines under the Act can reach the greater of ₦10 million or 2% of annual gross revenue for controllers of major importance, and the greater of ₦2 million or 2% for others, according to a summary of the law by identity firm Start With Identity. How those rules apply to a federal agency, and whether the NDPC opens a review, has not been announced.
The NDPC has spent the past two years pushing private companies to register, file compliance audits and report breaches. A public agency leaving backups in an open folder tests whether the same standard is applied to government. It follows questions raised this month about where state data lives, including the identity agency's statement that its database is locally hosted and managed by staff.
What to watch next
- Whether the BPE confirms which credentials were in the backups and that they have been changed.
- Whether it says what personal data, if any, the database held.
- Whether the NDPC or ngCERT comments on the report.
- Whether the forum listings Nwobi described are taken down or show signs of sale.
For other government bodies and the contractors who build their sites, the lesson is plain and cheap to act on. Keep backups off the public web root, switch off directory listing, and check what a search engine can see on your server before someone else does.
Afrotech Horizon contacted no new parties for this piece; facts are as reported by Techpoint Africa on October 21, 2026, unless stated otherwise.
