A massive data breach has allegedly hit the Punjab Land Records Authority (PLRA). A threat actor recently took to an underground forum to claim responsibility for the leak. Consequently, the compromised database reportedly exposes around 15.6 million property registry records, widely listed as 16 million.
🇵🇰 🚨 PAKISTAN: PUNJAB LAND RECORDS AUTHORITY DATABASE (16M RECORDS) ALLEGEDLY EXPOSED
A threat actor on an underground forum claims that a broken access control (IDOR) flaw in the PULSE (Punjab Urban Land Systems Enhancement) platform exposed the land registry database of the Punjab Land Records Authority, the provincial government body that manages land records in Pakistan’s Punjab province.
The actor claims the dataset includes:
* Around 15.6 million property registry records (listed as 16M)
* Citizens’ full names and spouse names
* Full 13-digit CNIC (national ID) numbers
* Property descriptions and property values (in PKR)
* Tehsil/mauza locations and transaction datesThe actor says the system’s API required no authentication and posted a sample registry record and proof screenshots.
The claim has not been independently verified.
⚠️ Analyst Note:
National ID numbers linked to property ownership and values are valuable for identity fraud, land-title fraud and targeted extortion or scam calls. If the access flaw is real and still open, the exposure may be ongoing. The Punjab Land Records Authority has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach.Source: this is for subscribers only. Subscribe: https://t.co/O5fslMgNk4
#DDW #DarkWeb #Pakistan #Punjab #Government #DataLeak #PII #ThreatIntelligence
— Dark Web Intelligence (@DailyDarkWeb) October 21, 2026
The leaked dataset contains highly sensitive personal information. It includes citizens’ full names, spouse names, and full 13-digit CNIC numbers. Furthermore, the leak exposes property descriptions, property values in PKR, transaction dates, and specific Tehsil or mauza locations.
The threat actor claims they exploited a broken access control (IDOR) flaw in the Punjab Urban Land Systems Enhancement (PULSE) platform. According to the forum post, the system API required zero authentication to access. The hacker even posted sample registry records and proof screenshots to back up their claims. However, independent sources have not yet verified the leak.
Security Researchers Ignored for Months
Following the news, several local penetration testers and security researchers voiced serious frustration. Multiple researchers reported this exact vulnerability to National CERT (PKCERT) through official vulnerability disclosure programs months ago. Unfortunately, authorities never replied to these reports. Officials provided no updates and completely failed to patch the vulnerable systems.
Additionally, researchers highlighted even more severe unpatched vulnerabilities. They reported that production servers suffered from Remote Code Execution (RCE) and SQL injection (SQLi) flaws. Security experts provided complete Proof of Concepts (PoCs) and even successfully pivoted into the internal network to demonstrate the risk. Despite these glaring red flags, authorities ignored the warnings and left the servers exposed without authentication. Researchers previously warned that someone would eventually exploit these flaws and steal the data.
PLRA Official Responds to Data Breach Allegations
The PLRA has not issued any official statements regarding the situation yet. But the Assistant Director (SOC) of PLRA took to LinkedIn and wrote:
PLRA categorically rejects misleading claims of a “data breach”, “hack”, or “leak”. No unauthorised intrusion, malware, ransomware, or data theft has been established. The API is an official public-service facility providing access to designated land-registry records. Misrepresenting lawful access to public records as a cyberattack is misleading and creates unnecessary alarm. PLRA remains committed to protecting citizens’ information and the integrity of Punjab’s land records.
Meanwhile, security researchers remain unconvinced by the official explanation. Cybersecurity professionals quickly dismissed the PLRA statement. They pointed out that organizations almost always issue identical blanket denials immediately following a major data leak.