PTA Clears Telecom Operators in Data Leak, Traces Breach to PITB and BISP

The Pakistan Telecommunication Authority (PTA) has completed its investigation into the alleged citizen data leak circulating online, concluding that the leaked information is outdated, largely inaccurate, and was not obtained from telecom operators. The probe also points to past data sharing with institutions such as the Punjab Information Technology Board (PITB) and the Benazir Income Support Programme (BISP) as potential sources of the leak.

Investigation Findings

According to PTA sources, the inquiry examined the origin and accuracy of the data available on the internet. Key findings include:

• Most of the citizen data available online is old and inaccurate.

• Telecom operators did not leak any user data. The information circulating was not sourced from telecom companies.

• The leaked data appears to have been aggregated from multiple sources rather than originating from a single database.

• Citizens’ Call Detail Records (CDRs), travel history, family tree information, and vehicle registration data are not maintained in a centralized location. Telecom operators do not possess all this information together.

• After being compiled from different sources, the data was possibly uploaded to the dark web, according to PTA sources.

Role of PITB and BISP

PTA highlighted that in 2022, it had shared certain datasets with the Punjab Information Technology Board (PITB) and the Benazir Income Support Programme (BISP) for legitimate administrative purposes. Sources noted that it is possible that the data shared with these institutions leaked and appeared online.

PTA also confirmed that it had previously conducted an investigation into a data leak in 2022, and the findings then also indicated that the data was old and not from telecom operators.

Forensic Analysis

A third-party forensic review was conducted to analyze the leak. The findings confirmed:

• The leaked data was not recent.

• Many records available online were incorrect, including mismatched mobile numbers, national identity card (CNIC) details, and addresses.

• PTA cross-checked the data of 1,500 mobile SIMs and found discrepancies, where mobile numbers, CNICs, and addresses often did not correspond to the same individual.

PTA’s Stance and Recommendations

PTA stressed that while telecom companies were not responsible, there is a critical need to strengthen data protection systems across government and public institutions. Sources highlighted the importance of robust mechanisms to secure citizens’ personal data and prevent such incidents in the future.

PTA also emphasized that it has repeatedly raised concerns about CDR data being made public and believes investigations should be conducted to determine who is responsible for the leak.

Next Steps

The PTA investigation report will be submitted to the Ministry of Interior, and in response, the Interior Minister has directed the Cyber Crimes Investigation Agency to carry out further investigations into the matter to ensure accountability and prevent similar breaches.

This investigation clarifies that telecom operators remain secure, but it raises questions about data governance and security practices in other government and affiliated institutions. It also underscores the need for a centralized, secure system to protect sensitive citizen information and ensure that legitimate administrative data sharing does not lead to exposure on public platforms.