Government Approves Formation of National Cybersecurity Authority After Major Cyber Breaches

Amid escalating digital and cyber threats, the government of Pakistan has decided to establish a federal-level National Cybersecurity Authority to strengthen the country’s defenses against cyberattacks and protect critical digital infrastructure.

According to official sources, the authority will be responsible for recommending security measures, ensuring nationwide implementation of cybersecurity initiatives, and serving as the central oversight body for digital risk management.

The Ministry of Information Technology has already drafted the Cybersecurity Act and circulated it among relevant stakeholders for feedback. Meanwhile, work on the National Cybersecurity Policy — a key component of the Digital Economy Enhancement Programme — is underway.

The decision follows the Ministry of IT’s admission to the National Assembly in September that Pakistan has suffered multiple major cyberattacks and data breaches in recent years. Due to the sensitivity of the matter, officials said the full details could not be disclosed publicly but could be shared in a closed-door briefing.

The ministry’s report highlighted Pakistan’s core challenges, including a shortage of skilled cybersecurity professionals, weak monitoring systems, and insufficient institutional reporting — gaps that allow many cyber incidents to go undetected.

One of the most serious breaches involved the Oil and Gas Development Company Limited (OGDCL), where hackers infiltrated the core data centre and deleted 21 virtual servers. Operations were restored after three days using a disaster recovery setup.

The report identified multiple root causes behind repeated cyberattacks: limited funding, lack of dedicated cybersecurity staff, weak oversight from senior management, and the absence of a strong governance and accountability framework.

Meanwhile, documents from the Ministry of IT show progress on the Secure Data Exchange Layer and digital identity systems. Data belonging to Nadra, FBR, telecom operators, and other key institutions has been officially designated as critical digital infrastructure — with Immigration and Passport systems also under review for the same status.

Until the National Cybersecurity Authority becomes fully operational, cyber incident coordination will continue under the CERT Council, which includes 14 public and private organisations working together to respond to emerging digital threats.