The federal agency that runs Nigeria's privatisation programme left complete copies of its website open on the internet for days. Chris Nwobi, founder of Zend Cybersecurity Threat Labs, found three WordPress backup archives on the Bureau of Public Enterprises (BPE) website, according to Techpoint Africa.
The folder listed its files publicly, so one click started a download. No login was needed. Nwobi confirmed the exposure on 17 October, and Techpoint says the files were still open when it checked on 19 October; it began a download without a password, then stopped.
What was inside
A WordPress backup normally holds a site's code, its settings and its database. Nwobi said these contained live database credentials and WordPress security keys. The database may also hold user accounts and anything visitors submitted through the site, which could bring the Nigeria Data Protection Act into play, Techpoint reports.
Nwobi also said dark-web monitors and at least one hacker-forum listing advertised "BPE 2024/2025 Backup" archives for sale, with names, dates and a description that match the open files. That claim is his; BPE has not confirmed it.
BPE declined to comment. By the time the story ran on 21 October, the site had been taken down and returned a 404 error. Nwobi said he notified BPE, ngCERT and the Nigeria Data Protection Commission.
More from AI and Tech StakCassava Will Resell Anthropic's Claude in AfricaStrive Masiyiwa's Cassava can now sell access to Claude through Amazon Bedrock, giving African firms a local partner to buy Anthropic's AI models from.The fix any site owner can copy
- Delete backup files from public web folders and store them off the server.
- Turn off automatic directory listing so folders cannot be browsed.
- Change every exposed password and key: database, admin, API and mail.
- Review access logs to see who downloaded what, and when.
