Pakistan govt entity hit by cyberattack last week, official says

A government entity in Pakistan came under a cyberattack last week and got its data encrypted, an official of the country’s national cyber defence agency PKCERT shared on Wednesday.

This took the total number of cyberattacks in Pakistan to 253 in the ongoing year 2026, said Pakistan Computer Emergency Response Team (PKCERT) Director General Dr Haider Abbas while speaking at a conference titled ‘Fortinet Security Day Karachi 2026 - Securing the AI Journey’ in Karachi.

“The government entity was hit by ransomware that encrypted its data and they had to recover their data from the backup systems,” Abbas said.

He, however, avoided mentioning the name of the entity.

“Amid this, all the public and private sector organisations have been given a six months deadline to establish their cybersecurity operation centres and make them operational as well,” he added.

Pakistan faced 927 cyberattacks in 2024 and 2025, according to PKCERT official.

“The attacks hit the critical infrastructure of the country, including the government and private sector organisations. These were the incidents that were successfully handled and successfully countered.”

Regarding the six months’ deadline to the organisations, Abbas said: “They have to deploy their [cyber] security operation centres (SOC) within their organisations and continuously monitor their threat landscape, [and] within the 6 months it should be fully operational”.

Pakistan has deployed a national CERT (Computer Emergency Response Team), which is responsible for preventing, detecting, and responding to cyberattacks. It does national level intelligence.

“We are collaborating with friendly countries’ CERTs and also share threat intelligence with them.”

At national level, Abbas continued, all the sector regulators in Pakistan would be considered as sectoral CERTs including Pakistan Telecommunication Authority (PTA) and all the telecom operators, State Bank of Pakistan (SBP) and all the banks, Securities and Exchange Companies of Pakistan (SECP), National Electric Power Regulatory Authority (NEPRA), Oil and Gas Regulatory Authority (OGRA), Higher Education Commission (HEC), and Civil Aviation Authority of Pakistan (CAA).

“They are in the process of deploying their sectoral CERTs at their organisations. At the next step, we are going to establish a federal government CERT also at national CERT.”

The government has developed its Pakistan Information Security Framework 2026 (PISF 2026), according to PKCERT official.

“This has compliance controls and auditing controls. This is currently under review by the Cabinet and has been presented to the parliament. Soon it will be approved and this will be the first cyber information security standard to be deployed in Pakistan including all centres.”

Meanwhile, SBP’s Information Technology Department (ITD) Director Ahmed Saeed said Pakistan’s banking sector was increasingly adopting hybrid cloud infrastructure to support artificial intelligence (AI), as building on-premises AI infrastructure required significant investment.

However, integrating public and private clouds increases security risk, reduces security visibility, and raises data privacy and regulatory compliance challenges, he highlighted.

Saeed urged banks in Pakistan to comply with the SBP cloud and cybersecurity frameworks and implement zero trust architecture, centralised identity and access management, cloud-native security monitoring integrated with on-premises systems, and consistent security policies.