Pakistan hit by massive data breach as citizens’ personal details sold online

Pakistan is facing one of its most alarming cybersecurity crises, with a disturbing surge in data breaches exposing sensitive personal information of millions of citizens.

Government records, mobile phone data, and national identity details are reportedly being sold openly on social media platforms for as little as 350 to 5,000 Pakistani Rupees ($1.5 to $15).

Several social media pages - still active at the time of reporting - are offering illicit services that include access to WhatsApp data, NADRA (National Database and Registration Authority) records with color scans of ID cards, call data records, live location tracking, and even individuals’ travel histories.

A single click often redirects users to WhatsApp numbers, where payments and data delivery are arranged.

- YouTube www.youtube.com

Alarming claims suggest that much of this data may be leaking from within official institutions themselves. Officers from the National Cyber Crime Investigation Agency (NCCIA) told reporters that hackers and data brokers are obtaining information directly from insiders at NADRA, mobile network operators, and other government-linked entities.

A recent advisory by Pakistan’s National Cyber Emergency Response Team revealed that data of more than 184 million citizens has already been compromised. This includes passwords for Google and social media accounts, login credentials for government portals, banking information, and personal health records - raising serious concerns about vulnerabilities across both public and private sectors.

Responding to mounting public outrage and the potential national security fallout, Interior Minister Mohsin Naqvi has formally taken notice of the issue. A Special Investigation Team (SIT) under the NCCIA has been formed, with a detailed report expected within two weeks.

Cybersecurity experts warn that without urgent systemic reforms, Pakistan could remain exposed to large-scale exploitation of its citizens’ data, carrying profound implications for privacy, national security, and digital trust both domestically and internationally.