Hackers breach Pakistan's CDA billing system, demand ransom in bitcoins

The Capital Development Authority (CDA) of Islamabad has spent three tense days as unknown hackers breached its property and water billing system and demanded ransom in bitcoins.

The CDA’s data related to property and conservancy charges has been compromised, and the hackers are allegedly threatening to upload the data on the dark web if the ransom is not paid, sources have revealed.

“Since it is the closing month of June, and a large number of people clear their property and tax dues this month, our systems have been hacked for the last three days,” said an official of the CDA revenue directorate.

He said the revenue directorate, CDA’s vendor NRTC, and the Information Technology Department were making all-out efforts to restore the data. “Hopefully, the matter will be resolved by Friday (today),” he said.

Meanwhile, several citizens said they were unable to pay their taxes as CDA’s online links remained down. The CDA website was functional, however, the “Pay your bills online” link has been inaccessible.

The civic agency maintains data of all residential and commercial properties in city areas, including allotted residential and commercial plots, while properties in rural areas are handled by the revenue department of the district government.

Earlier, in 2024, Indian hackers reportedly breached the CDA website and uploaded data on the dark web. The website was restored after a few days, and the incident raised alarm not only within the civic body but also at the federal government level.

Following that incident, the Prime Minister’s Office (PMO) also took notice. The CDA board later authorised the civic agency to engage a cyber security firm under a running contract to safeguard its digital infrastructure and services.

An official of the IT wing said that after the 2024 incident, a cyber security firm had been engaged by the CDA.

Meanwhile, another official claimed that CDA and its vendor had no backup data for the last six months; however, the claim was rejected by CDA spokesperson Shahid Kiani.