A hacker posted on an underground forum saying they had accessed the Punjab Land Records Authority (PLRA) database, releasing roughly 15.6 million property registry entries, often quoted as 16 million. The claim was made recently and the leak allegedly contains full names, spouse names, 13-digit CNIC numbers, property descriptions, values in PKR, transaction dates and specific Tehsil or mauza locations.
🇵🇰 🚨 PAKISTAN: PUNJAB LAND RECORDS AUTHORITY DATABASE (16M RECORDS) ALLEGEDLY EXPOSED A threat actor on an underground forum claims that a broken access control (IDOR) flaw in the PULSE (Punjab Urban Land Systems Enhancement) platform exposed the land registry database of the Punjab Land Records Authority, the provincial government body that manages land records in Pakistan’s Punjab province. The actor claims the dataset includes: * Around 15.6 million property registry records (listed as 16M) * Citizens’ full names and spouse names * Full 13-digit CNIC (national ID) numbers * Property descriptions and property values (in PKR) * Tehsil/mauza locations and transaction dates The actor says the system’s API required no authentication and posted a sample registry record and proof screenshots. The claim has not been independently verified. ⚠️ Analyst Note: National ID numbers linked to property ownership and values are valuable for identity fraud, land-title fraud and targeted extortion or scam calls. If the access flaw is real and still open, the exposure may be ongoing. The Punjab Land Records Authority has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: https://t.co/O5fslMgNk4 #DDW #DarkWeb #Pakistan #Punjab #Government #DataLeak #PII #ThreatIntelligence
— Dark Web Intelligence (@DailyDarkWeb) October 21, 2026
The attacker says they used an insecure IDOR flaw in the Punjab Urban Land Systems Enhancement (PULSE) platform, noting that the API required no authentication. Sample records and screenshots were posted as proof, though independent verification is still pending.
Security Researchers Ignored for Months
Local penetration testers and security experts expressed anger after reporting the same vulnerability to the National CERT (PKCERT) through official disclosure channels months earlier, receiving no response. Authorities gave no updates and did not patch the exposed system.
Researchers also warned of additional unpatched flaws, including Remote Code Execution (RCE) and SQL injection (SQLi) on production servers. They shared full proof-of-concept code and even accessed the internal network to illustrate the danger, but officials continued to ignore the warnings, leaving the servers open without authentication.
PLRA Official Responds to Data Breach Allegations
The PLRA has not released an official comment, but its Assistant Director (SOC) posted on LinkedIn, stating:
PLRA categorically rejects misleading claims of a "data breach", "hack", or "leak". No unauthorised intrusion, malware, ransomware, or data theft has been established. The API is an official public-service facility providing access to designated land-registry records. Misrepresenting lawful access to public records as a cyberattack is misleading and creates unnecessary alarm. PLRA remains committed to protecting citizens' information and the integrity of Punjab's land records.
Security researchers remain skeptical of the statement, noting that organizations typically issue blanket denials after a major leak.
