Pakistan hit by major cyberattacks, government sets up emergency response teams

Pakistan has experienced several notable cyberattacks and data breaches in recent years, the Ministry of Information Technology and Telecommunications stated in a report submitted to the National Assembly.

Due to the sensitive nature of this issue, the ministry stated that it cannot share with the public any details but can discuss publicly with lawmakers in private.

The report indicated that many cyber incidents go unnoticed or unreported due to weak monitoring systems, a lack of expertise and poor security practices at the institutional level.

Notably, the report outlines one of the major breaches that occurred at the Oil and Gas Development Company Limited (OGDCL). The hack involved breaking into OGDCL's core data centre and erasing 21 discrete virtual servers, which forced the company to operate for three days through its disaster recovery system to restore operations.

The report also delineated another incident at the National Telecommunication Corporation (NTC) where an advanced hacking group had access to the Zimbra email platform to impersonate some official users.

With regard to federal accounts, the National Information Technology Board (NiTB) also verified that they were victimised with multiple high-level accounts being compromised across federal ministries, while the Ministry of Foreign Affairs (MOFA) was the victim of attacks that identified links to known international command-and-control servers.

MoITT ultimately admitted that the resource gaps and lack of dedicated cybersecurity staff aggravated exposures and breaches.

To counter these threats, the government has introduced a new cybersecurity strategy. A national-level Cyber Emergency Response Team (nCERT) has been established to lead detection and response, supported by a National Security Operations Centre (NSOC) for continuous monitoring.

Plans are also underway to set up six provincial CERTs and three sectoral CERTs, while training programmes have been launched to boost cyber defence skills in government institutions.