Key points

  • The National Cyber Crime Investigation Agency (NCCIA) detained two suspects in Lahore for operating the illicit “Mini NADRA” portal.
  • The website allegedly offered personal information—names, CNIC numbers, addresses and more—of over 10 million Pakistanis for sale on the dark web.
  • Authorities describe the scheme as a coordinated cyber‑crime ring that sourced data from unofficial channels and monetised it illegally.
  • The bust highlights escalating concerns over digital privacy in Pakistan and signals a crackdown on underground data‑trading networks.

The NCCIA announced that the two arrested men, identified as Muhammad Arsalan and a co‑accused, were apprehended after a weeks‑long cyber‑forensic operation. Investigators say the “Mini NADRA” platform functioned as a marketplace where buyers could purchase bulk records of Pakistani citizens, including their Computerised National Identity Card (CNIC) numbers, full names, family details and, in some cases, contact information. The data was reportedly harvested from a mixture of leaked databases, phishing campaigns and unauthorized scrapes of government portals, then uploaded to hidden services for resale.

The scale of the breach is staggering: with more than 10 million records compromised, roughly one in eight Pakistanis could see their identity details exposed. Such information can be weaponised for financial fraud, SIM‑card cloning, loan scams and even political manipulation. Consumer rights groups have warned that the fallout could disproportionately affect vulnerable populations in rural areas, where verification processes often rely heavily on CNIC data.

In a press briefing, NCCIA’s director emphasized that the operation is part of a broader effort to dismantle illicit data‑trading ecosystems that have proliferated since the surge in digital services across the country. The agency has already initiated steps to trace downstream purchasers and to coordinate with the Pakistan Data Protection Authority (PDPA) for stricter enforcement of the 2023 Personal Data Protection Ordinance. Meanwhile, the Ministry of Interior has urged citizens to monitor their credit reports and to report any suspicious activity linked to their identity documents.

The “Mini NADRA” case serves as a stark reminder that Pakistan’s rapid digital transformation must be matched by robust cybersecurity measures and public awareness. Experts argue that strengthening legal frameworks, improving inter‑agency data sharing, and launching nationwide education campaigns are essential to curb future breaches and protect the personal information of millions of Pakistanis.