Last Verified: May 2026 | By SimOwner.net.pk Editorial Team — Pakistan’s SIM fraud documentation specialists since 2015
In September 2019, cybersecurity researchers publicly disclosed that data belonging to approximately 115 million Pakistani mobile subscribers had been listed for sale on the dark web. The dataset included names, CNIC numbers, phone numbers, home addresses, and network operator details. For many Pakistanis, this was the first time they understood that their CNIC number — the single identity document connecting them to every SIM, bank account, property record, and government service — had been exposed.
It was not the first such breach. And it was not the last.
Pakistan has experienced a documented pattern of CNIC and subscriber data exposures over the past decade. This guide explains what was actually leaked in each major incident, what specific risks these leaks create for SIM fraud, how to assess whether your personal information was part of a breach, and the concrete actions that reduce your exposure regardless of whether your data was compromised.
Before going further — if you have never checked which SIMs are currently registered on your CNIC, do that first at SIM Database. A compromised CNIC number is most immediately dangerous when it is used to register unauthorized SIMs.
Pakistan’s Major CNIC and Subscriber Data Breaches — A Documented Timeline
The 2019 Pakistani Mobile Subscriber Database Leak
What happened: In April 2019, a threat intelligence firm (Dehashed) and subsequently multiple cybersecurity researchers reported a database containing records of approximately 115 million Pakistani mobile subscribers appearing on dark web forums. The seller was asking for $2,500 for the full dataset.
What was in the data: Researchers who sampled the dataset found it contained:
- Full name (as registered with network operator)
- CNIC number (13-digit)
- Mobile phone number
- Home address
- Network operator (Jazz, Zong, Telenor, Ufone)
- In many records: subscriber status, SIM registration date
Believed source: The dataset appeared consistent with operator-level subscriber registration records — not a NADRA breach of biometric data. The data structure matched what mobile network operators maintain in their subscriber databases.
PTA and government response: PTA acknowledged awareness of the reports and stated an investigation had been initiated. No formal public report with conclusions was released. Individual operators denied being the direct source.
The SIM fraud implication: This dataset, if accurate, gave criminals a near-complete directory of Pakistani mobile subscribers with CNIC numbers — enough information to attempt targeted SIM swap fraud against specific individuals, or to run automated attacks against weakly verified franchise systems.
The 2020 NADRA Data Concerns
What happened: In 2020, reports circulated on Pakistani social media and cybersecurity forums suggesting that CNIC information — including images of CNIC front and back — was available for purchase through informal Telegram and WhatsApp channels. These were described as being offered by individuals with access to NADRA or network operator systems.
What is verified vs. claimed: The availability of CNIC images and data through informal channels is well-documented by Pakistani cybersecurity professionals and journalists. The exact origin — whether from NADRA systems, operator databases, or aggregated from franchise-level photocopies — has not been authoritatively established.
The distinction matters: If CNIC images (not just numbers) are circulating, this represents a higher-risk exposure — because CNIC images can be used to create physical forgeries, and because the image contains information (signature, photo) beyond what the number alone provides.
The 2023 Telecom Data Reports
What happened: In mid-2023, Pakistani cybersecurity researchers and international threat intelligence firms reported fresh Pakistani telecom data appearing in dark web marketplaces. This data was represented as more current than the 2019 dataset, suggesting an ongoing or more recent exposure.
What was reportedly in the data: Updated subscriber records with similar fields to the 2019 dataset, plus in some samples, reported income estimates and property records linked to CNICs.
Response: PTA directed operators to review their data security practices. Pakistan’s then-nascent Personal Data Protection Bill (later enacted as the Personal Data Protection Act) was cited as a framework for addressing such exposures going forward.
The Ongoing “CNIC for Sale” Problem
Beyond large-scale database breaches, Pakistan has a persistent small-scale CNIC data leak problem: franchise employees, bank staff, utility company workers, and others with legitimate access to CNIC photocopies sometimes sell this information informally.
This is not a single breach event — it is a continuous, distributed leakage. Every entity that collects your CNIC photocopy is a potential source of information exposure. The scale of legitimate CNIC photocopy collection in Pakistan (for SIM registration, bank accounts, utility connections, apartment rentals, university enrollment, and dozens of other purposes) means that most Pakistanis’ CNIC information has been accessible to potentially hundreds of individuals across their lifetime.
What Specific Information Creates SIM Fraud Risk
Not all leaked information carries equal fraud risk. Understanding what combination of data elements creates actionable SIM fraud risk helps you assess your exposure:
High-Risk Combination: CNIC Number + Mobile Number + Name + Address
This combination is sufficient for a criminal to:
- Attempt a fraudulent SIM replacement at a franchise (presenting this information as “proof” while hoping biometric verification is bypassed)
- Attempt MNP fraud by social engineering a PAC code from the victim
- Target the victim with sophisticated phishing calls using their real name and partial CNIC details to establish false credibility
Medium-Risk: CNIC Number + Name Only
Sufficient for:
- Attempts at franchise-level fraud relying on corrupt employees
- Social engineering calls where the criminal presents partial information convincingly
- Attempts to construct full profiles by combining with other public data sources
Lower-Risk: Mobile Number Only
On its own, a mobile number without CNIC details is less dangerous for SIM fraud — though it enables OTP farming attempts (calling the number to trick the holder into sharing OTPs) and SIM card targeting.
How to Check If Your CNIC Information Was Part of a Breach
Method 1 — Check via International Breach Databases
HaveIBeenPwned.com (haveibeenpwned.com): The most reputable free breach checking service. Primarily tracks email address exposures. Enter your email address to see whether it appeared in any known data breach.
Limitation: HaveIBeenPwned does not index CNIC numbers directly. The 2019 Pakistani mobile breach was indexed under email addresses where emails were present in the data — but the majority of the Pakistani dataset did not include email addresses.
Dehashed.com: A paid breach database that includes more data types including phone numbers. A phone number search may reveal whether your number appeared in breach datasets.
Method 2 — Behavioral Indicators (The Most Reliable Signal in Pakistan)
Because Pakistan-specific CNIC breach data is not reliably searchable through international tools, behavioral indicators are often more informative than database checks:
Indicator 1 — Unsolicited calls using your real name and partial CNIC details. If you receive calls where the caller knows your full name and references your CNIC number or partial details without you providing them — your information is likely in circulation.
Indicator 2 — SIM registration attempts you did not initiate. If 668 shows more SIMs than you registered, or if you receive network notifications about account changes you did not request — your CNIC information is being actively used.
Indicator 3 — Targeted phishing. Receiving phishing messages that include your real name, mobile number, and reference your network operator accurately (rather than generic “Dear User” messages) suggests your subscriber record may have been exposed.
Indicator 4 — Loan or wallet applications in your name. If you receive approval or rejection notices for microloans, mobile wallet accounts, or other financial products you never applied for — your CNIC is being used by someone else.
Method 3 — Check Your CNIC’s Active SIMs
The most actionable breach check for SIM fraud risk is simply verifying how many SIMs are currently active on your CNIC. Send your CNIC number (without dashes) to 668 from any Pakistani network, or use the SimOwner.net.pk SIM database verification to check and interpret your results.
If any SIMs in the 668 response are ones you do not recognize — your CNIC information has already been used for fraud, regardless of which breach database it came from.
What Happens When Your CNIC Number Is in Circulation Among Fraudsters
Understanding the criminal workflow after a CNIC breach helps you understand what specific protections are most important:
Stage 1 — Data validation. Criminals who acquire a breach database first validate which records are “live” — i.e., which CNIC numbers still have active SIMs registered. This validation is done by calling the phone numbers in the dataset and checking if they are active. This is why some Pakistanis receive unexplained calls from unknown numbers — their number is being validated against a breach dataset.
Stage 2 — Target selection. From the validated records, criminals select targets based on perceived financial value. Records with home addresses in affluent areas, records from certain professions (inferred from patterns), and records linked to high-end mobile numbers are prioritized.
Stage 3 — Attack execution. The selected CNIC is used for SIM swap or MNP fraud attempts, typically targeting the victim’s mobile wallet and banking OTP pathway.
Stage 4 — Resale. Successfully validated and enriched records (CNIC + mobile number + confirmed active) are resold to other criminal actors at higher prices than the original breach data.
Pakistan’s Legal Framework for Data Breach Response
Personal Data Protection Act (PDPA) 2025
Pakistan enacted its Personal Data Protection Act in 2025 — the primary law governing data security obligations for organizations that collect and process personal data including CNICs.
Key provisions relevant to breach:
Breach notification requirement: Organizations that experience a data breach affecting personal information are required to notify affected individuals and the Personal Data Protection Authority (PDPA) within a specified timeframe. This is a major change from pre-2025 practice where breaches were often not disclosed publicly.
Data minimization: Organizations are required to collect only the data necessary for their stated purpose. The widespread CNIC photocopy collection in Pakistan is increasingly under scrutiny under this principle.
Data subject rights: Individuals have the right to request what data an organization holds about them and in some circumstances to request deletion. This applies to mobile network operators, banks, and other entities holding CNIC data.
PECA 2016 Application to Data Breach
PECA 2016 remains relevant for criminal prosecution of:
- Unauthorized access to data systems (the breach itself) under Section 14
- Unauthorized copying or transmission of personal data under Section 15
- Sale of identity information under Section 16
Criminal penalties for data breach perpetrators: up to 3 years imprisonment and Rs. 5,000,000 fine per violation.
Concrete Steps to Protect Yourself After a Data Breach
Whether or not you have confirmed your CNIC was in a specific breach, the following actions significantly reduce your SIM fraud risk:
Immediate Actions (Do Today)
1. Check your CNIC’s SIM registrations. Send CNIC to 668 or use Pak SIM Data. If anything is unexpected, block unauthorized SIMs immediately.
2. Add fraud flags to your mobile accounts. Call each network where you have a SIM and ask them to add a security note requiring enhanced in-person verification for any account changes.
3. Enable Two-Step Verification on WhatsApp. WhatsApp → Settings → Account → Two-Step Verification. A PIN prevents account takeover even if someone SIM-swaps your number.
4. Review your JazzCash/Easypaisa transaction limits. Lower them to the minimum you actually need. A lower limit reduces the maximum loss if your wallet is accessed fraudulently.
5. Switch banking OTPs to authenticator app where possible. Some Pakistani banks (HBL, MCB) allow Google Authenticator-based 2FA for their apps. This is immune to SIM swap.
Medium-Term Actions (This Week)
6. Audit every entity that has your CNIC photocopy. Think through the last 5 years — SIM registrations, bank accounts, university, apartment rental, utility connections. Every one is a potential source of your CNIC information. You cannot un-share historical photocopies, but you can be more selective going forward.
7. Obtain a NADRA Smart Card CNIC if you have an older CNIC. The newer CNIC Smart Cards have embedded security chips that are harder to counterfeit than older laminated versions. Visit any NADRA Registration Centre — Smart Card issuance takes 3–5 working days.
8. Update your NADRA biometric data if it is old. If your CNIC was last renewed more than 7–8 years ago, your stored fingerprint templates may not match your current fingerprints well — causing legitimate verification failures. Updated biometric enrollment reduces false rejection rates and ensures your biometric record is current.
9. Register a verbal password with your bank and mobile networks. Any account changes require this verbal code — adds a layer that breach data alone cannot bypass.
The CNIC Information Pakistan’s Laws Now Protect
Under the PDPA 2025, CNIC number is classified as sensitive personal data — entitling it to the highest level of protection in data handling. Organizations collecting it must:
- Obtain explicit consent
- Use it only for the stated purpose
- Not share it with third parties without consent
- Maintain security measures against unauthorized access
- Delete it when no longer needed for the purpose it was collected
For more on how Pakistan’s official CNIC information systems work and what data is legitimately accessible, see the CNIC information resources at SimOwner.net.pk.
Frequently Asked Questions
Q: Can I find out if my specific CNIC number was in the 2019 breach? A: There is no publicly available, reliable lookup specifically for the 2019 Pakistani mobile breach by CNIC number. The dataset was not indexed by international services like HaveIBeenPwned in a way that enables individual CNIC lookups. The behavioral indicators described in this guide (unsolicited calls using your details, SIM registration attempts) are the most practical signal.
Q: If my CNIC was in a breach, does that mean I will definitely be targeted? A: Not necessarily — criminals work through breach data in batches, targeting those with highest perceived financial value first. However, breach exposure does statistically increase your risk. The protective measures in this guide significantly reduce that risk regardless.
Q: Does NADRA know if its systems were breached? A: NADRA has consistently maintained that its core biometric database was not breached in the documented incidents — the breaches appear to have affected network operator subscriber databases (which contain CNIC numbers but not biometric templates). NADRA conducts regular security audits. Under the PDPA 2025, any future confirmed breach of NADRA systems would require public notification.
Q: I received a call where the person knew my CNIC number. What should I do? A: Treat this as confirmation that your CNIC information is in circulation. Do not share any additional information during the call. Hang up. Then: check your 668 SIM status, add fraud flags to your network accounts, and monitor your bank/wallet accounts for unauthorized activity.
Q: Can I sue a company if my CNIC data was leaked through them? A: Under the PDPA 2025, yes — data subjects have the right to seek compensation for damages resulting from an organization’s failure to protect their data. The PDPA establishes the Personal Data Protection Authority as the regulatory body for complaints. Civil action through courts is also available. Consult a lawyer for case-specific advice.
Q: My CNIC number is visible in old ID photocopy photos shared on social media. What should I do? A: Request removal from the social media platform where the image is posted. For Facebook and Instagram, use the “report” function. For WhatsApp group shares, contact the group admin. While historical exposures cannot be completely reversed, reducing ongoing exposure is still worthwhile. The critical protective step is adding fraud flags to your mobile and bank accounts so that CNIC number alone is insufficient for fraudulent access.
Q: Does changing my CNIC (renewing) change my CNIC number? A: No. Your CNIC number is tied to your identity and does not change upon renewal. Renewal updates your photograph, address if changed, and biometric data — but the 13-digit number remains the same throughout your life. This is why CNIC breach exposure is a permanent risk — unlike a leaked password, which can be changed.
Summary: Your Data Breach Response Priority List
| Priority | Action | Time Required |
|---|---|---|
| 1 | Check SIMs on CNIC via 668 | 30 seconds |
| 2 | Add fraud flags to network accounts | 10 minutes per network |
| 3 | Enable WhatsApp Two-Step Verification | 2 minutes |
| 4 | Lower mobile wallet transaction limits | 5 minutes |
| 5 | Switch banking OTPs to authenticator app | 15 minutes |
| 6 | Update NADRA biometric data (if old CNIC) | 1 visit to NADRA |
| 7 | Register verbal passwords with bank | 10 minutes |
| 8 | Audit CNIC photocopy exposure | Ongoing awareness |
A CNIC breach cannot be undone — but its consequences can be significantly limited through the layered protections described in this guide. The breach puts your CNIC number in criminal hands; these protections make that number insufficient to actually execute fraud against you.
For ongoing monitoring tools, SIM verification, and Pakistan’s most comprehensive CNIC protection resources, visit Sim Owner Details — independently documenting Pakistan’s telecom security landscape since 2015.
Breach timeline based on publicly available cybersecurity research reports and Pakistani media coverage. PDPA 2025 references based on enacted legislation. SimOwner.net.pk is not affiliated with NADRA, PTA, or any network operator.
Related Guides on SimOwner.net.pk:
SS7 Attack Explained — Can Hackers Intercept Pakistani SMS OTPs and What Can You Do About It (2026)
Deceased Family Member’s CNIC — How to Check and Block SIMs Before Fraudsters Do (Pakistan 2026)
How to Register a SIM for a Minor (Child Under 18) in Pakistan — Legal Rules and Parent Guide 2026
How Criminals Register SIMs Using Your CNIC in Pakistan — And Exactly How to Stop Them (2026)