The Media Line: Big Data Leak in Pakistan: Where Is the Government Control?  

Audio By Carbonatix

Enlarge

Big Data Leak in Pakistan: Where Is the Government Control?  

Security and Defense Analyst Adeeb Uz Zaman Safvi says the breach is ‘a threat against national sovereignty’ 

By Arshad Mehmood / The Media Line 

[Islamabad] Pakistan is grappling with serious fallout after a massive data breach exposed the personal information of thousands of citizens, including federal ministers and senior officials. Authorities have launched a federal-level inquiry into the incident. 

On the orders of Federal Interior Minister Syed Mohsin Naqvi, a special team from the National Cyber Crime Investigation Agency has been tasked with investigating. A report on the findings is expected within 14 days. 

According to a press release issued by the interior ministry, the team will conduct a full assessment of the breach, identify those responsible, and ensure accountability through legal action. 

Sensitive personal data, including national ID copies, call records, SIM ownership details, and international travel information, is reportedly being sold online at very low prices. The breach not only violates individual privacy but also poses a grave threat to national security and the credibility of state institutions. 

Reports suggest that even Interior Minister Naqvi’s data was advertised for sale on Google. Records range from federal ministers to Pakistan Telecommunication Authority (PTA) spokespeople and employees of various government agencies. 

Dozens of websites are offering sensitive data, including mobile location information, call records, and overseas travel histories. According to BiometricUpdate.com, mobile location data is being sold for 500 Pakistani rupees ($1.76), detailed call records for PKR 2,000 ($7), and travel histories for PKR 5,000 ($17.55).  

The PTA previously claimed to block such websites, yet the illegal trade continues. Multiple platforms are still selling personal records, leaving citizens exposed to harassment, blackmail, and criminal exploitation. 

Intelligence officials have warned that hostile actors could weaponize this data to target individuals cheaply and effectively. Citizens are being urged to change passwords, enable two-factor authentication, review SIMs registered under their national IDs, and report suspicious activity to cybercrime authorities. 

The breach is especially troubling as Pakistan pushes forward with its digital transformation, expanding electronic ID systems and promoting cashless payment platforms. 

Only months ago, Pakistan’s National Cyber Emergency Response Team reported that login credentials for over 180 million users had been stolen in a global data leak. Victims included users of social media, government portals, banks, and healthcare systems. 

The agency warned of risks including account hijacking, identity theft, and unauthorized access to sensitive networks. 

Back in March 2024, a Joint Investigation Team reviewing a breach at the National Database and Registration Authority informed the interior ministry that personal credentials of nearly 2.7 million people had been exposed between 2019 and 2023. 

This latest breach comes alongside a corruption scandal in Pakistan’s biometric welfare program. An audit of the Benazir Income Support Program (BISP), which provides cash aid to nearly a quarter of the population, revealed that over 300 officials were implicated in wrongdoing. 

Pakistan’s Auditor General found that 324 BISP officials siphoned more than 37 million rupees (around $130,000) through fraudulent methods, including manipulated biometric verification. 

At the same time, Amnesty International accused Pakistan of widespread surveillance. In its “Shadows of Control” report, Amnesty said Pakistan uses a Chinese-made firewall and phone-tapping system, supplemented by technology from the US, Germany, France, Canada, and the UAE.  

Pakistan’s Web Monitoring System and Lawful Intercept Management System function like digital watchtowers, keeping a constant eye on the daily lives of ordinary citizens. 

Agnes Callamard, Amnesty International Security General, said: “In Pakistan, texts, emails, calls, and internet activity are under constant, hidden surveillance, severely restricting freedom of expression and access to information.” 

The timing of Amnesty’s report has fueled even more concern, as news of the breach spreads across Pakistan.   

Security experts spoke with The Media Line and argued that the situation is a national security crisis.  Adeeb Uz Zaman Safvi, a Karachi-based retired navy captain and seasoned security and defense analyst, told TML, “The breach highlights a massive national security risk, going beyond a mere privacy issue to a threat against national sovereignty.”  

Safvi underlined, “In a country facing persistent terrorism and hybrid warfare threats, adversarial intelligence agencies could exploit this data to map government communication networks, infiltrate decision-making circles, or monitor the movements of policymakers.” 

He went on to say that “perhaps the most damaging aspect is the erosion of public trust. For years, Pakistan’s government has urged citizens to link their mobile numbers with their national IDs, promising security and protection. When the system meant to safeguard citizens becomes the source of a breach, it betrays that trust.” 

Safvi continued, “Cybersecurity is now the fifth domain of warfare, and exposed data gives hostile actors an easy tool to exploit vulnerabilities, amplifying risks across political, military, and social spheres.” 

He added that the crisis exposes major weaknesses in Pakistan’s cybersecurity framework, including the lack of a strong, independent data protection authority. 

Safvi concluded that the sale of millions of citizens’ personal records to malicious actors deepens public mistrust and highlights the urgent need for reforms to safeguard governance and national security. 

Ajmal Sohail, a senior counterterrorism expert and intelligence threat analyst, told The Media Line that “In a region increasingly defined by asymmetric threats and hybrid warfare, the recent security breach poses significant risks that extend far beyond a simple lapse in cybersecurity.” 

He emphasized that the incident could empower adversaries to map sensitive networks, compromise critical communications channels, and exploit behavioral patterns of key decision-makers, thereby undermining national security at its core. 

Sohail noted that “The situation is further exacerbated by the revelation that even the data of the interior minister was compromised and subsequently advertised on Google, highlighting a troubling lack of immunity and vulnerability at the highest echelons of government.” 

 He emphasized that Pakistan’s fragile security, marked by militant resurgence, political instability, and economic pressures, makes this breach especially dangerous. 

Sohail added that exposure of travel and location data could enable targeted attacks, blackmail, or coercion, particularly against officials involved in counterterrorism or sensitive negotiations. 

 He concluded that this is not just an isolated failure; it is a wake-up call for urgent reforms, technological upgrades, and stronger digital sovereignty. 

Syed Jowdut Nadeem, a digital rights activist and member of the Human Rights Commission of Pakistan, observes this crisis as both alarming and deeply personal. 

 “When the state fails to protect the privacy of its citizens, it is not just a technical failure but a violation of constitutional rights. The guarantees of the right to life and privacy are being undermined,” Nadeem said to TML. 

 Nadeem echoed that this breach is not just about SIM records or ministers’ data being exposed; it concerns ordinary people, students, women, journalists, and activists, whose personal information could now be exploited by criminals, extremist groups, or even hostile foreign actors. 

He added that in a country already struggling with issues of enforced disappearances, surveillance, and harassment of dissenting voices, the exposure of citizens’ data adds another terrifying layer of vulnerability. 

According to Nadeem, the open sale of such sensitive data, even on Google, reflects a system that prioritizes control over citizens rather than their protection. With past breaches already weakening trust, incidents like this only erode it further.  

He stressed that “The real crisis is not just the breach, but what it reveals: a government that talks about security yet fails to protect its citizens’ dignity, identity, and safety. This is a human rights issue that demands accountability and urgent reforms.” 

Syed Khalid Muhammad, Executive Director of CommandEleven, a full-service organization specializing in intelligence, risk assessment, and geopolitical communications, told The Media Line, “This is neither the first nor likely the last major data breach in Pakistan. Over the years, several high-profile incidents have exposed the country’s digital vulnerabilities.” 

Muhammad also noted that “this is at least the fifth major breach of Pakistan’s data networks, with little effort by successive governments to secure core databases. The problem has been growing since 2017, with no significant response from government, security, or intelligence institutions.” 

Muhammad emphasized, “The latest national data breach continues this troubling trend, showing that institutional safeguards remain inadequate, putting ordinary citizens, corporations, service providers, and even government and military institutions at significant risk.” 

He concluded that “agencies like the National Security Advisor’s office, the Federal IT Ministry, the Intelligence Bureau, and the Federal Investigation Agency should have been directly tasked with preventing such hacks.”