Digital government can be used to improve speed, efficiency, and accessibility of public services. As digital systems become increasingly prevalent, they also pose new threats if the infrastructure supporting them is not well secured and managed. The recent digital attack on the Capital Development Authority (CDA) billing system in Islamabad is a loud warning that Pakistan must be prepared to develop a strong cyber defence system to build a digital state.
On June 19, 2026, the CDA’s property, conservancy, and water billing system was compromised, resulting in the disruption of online billing for approximately three days. Hackers are demanding a ransom in Bitcoin and threatening to release the leaked information on the darknet. The timing was worse because June is the last month of the fiscal year, and during this time, many residents pay taxes and other fees.
This was not just a ‘technicality’. It disrupted a key government service and may have made the information regarding Islamabad’s properties and their owners accessible. The CDA keeps records of residential and commercial properties in the capital, and their digital systems are an appealing target for the CDA.
The saddest part of it is that this was not the first cyber incident for CDA. The authority’s website had reportedly been hacked and data uploaded to the dark web in 2024. This episode was being discussed at the federal level, even at the Prime Minister’s level. Later, the CDA approved the contract with a cybersecurity company for safeguarding their digital data.
Two years later, the authority faced another major cybersecurity controversy.
This raises an important question: Was a security firm brought in after the 2024 incident, and if so, how did the CDA find itself facing another serious breach in 2026?
The deeper issue is that public-sector cybersecurity is often treated as a one-time contract rather than as a continuous risk-management process. Hiring a cybersecurity company or deploying a security solution does not, by itself, guarantee protection. Systems must be regularly assessed for vulnerabilities, promptly patched, protected through strong access controls and multi-factor authentication, continuously monitored, and supported by trained staff. Organizations must also maintain reliable backups and have a clear incident-response plan in place. Most importantly, these measures should be tested regularly and not assumed to work.
The CDA case also raises awareness of the danger of reliance on third-party technology providers. CDA’s IT department, the revenue directorate, and National Radio and Telecommunication Corporation (NRTC) were involved in the billing system recovery. With the use of vendors, division of cybersecurity responsibilities is essential when government agencies rely on vendors. No organisation should be in the dark about access control, system monitoring, updates, and accountability in case something goes wrong.
The controversy over the backup is telling enough of a story. One official said that CDA and its vendor didn’t have the backup data of the previous six months, and CDA spokesman Shahid Kiani denied the statement, claiming that the backup data had been safe. In both cases, the controversy highlights the need for policies to be tested on their own and properly documented, as the results of applying backup policies can vary significantly. A backup is only useful if it is able to recover from an attack.
The broader national context compounds the CDA incident’s worry. In July 2026, the National Cyber Emergency Response Team (PKNERT) of Pakistan warned of a ransomware attack that had taken place in a government institution where the data was encrypted and restored through backups. A representative of the PKCERT has also revealed that 253 cyberattacks have been registered in Pakistan to date in 2026. The incident has been taken very seriously, with the Ministry of Interior later initiating an investigation into the CDA breach.
Pakistan already has a national cybersecurity framework in place and a dedicated National CERT. The challenge is creating policies. It’s getting these policies to be followed by government institutions.
The attack by the CDA should be seen not as an isolated occurrence but a wake-up call. There is a vast amount of personal, financial, and property information in the hands of government agencies. The effects of a successful attack are going to be increasingly felt as more public services go online.
Pakistan needs to move beyond reactive cybersecurity and be in a state of continuous cyber resilience. Government institutions should independently review their own security controls, implement multi-factor authentication, isolate sensitive systems, track access to vendors, have offline and tested backups, and regularly practice ransomware response drills. Faster reporting of cyber incidents to the national authorities is also crucial to enable lessons to be learned from one incident and to protect other institutions.
The real lesson to be learned from the CDA breach is that digital infrastructure is now public infrastructure. Preserving a billing system is not only an IT obligation, but also a public trust obligation, an economic continuity obligation and a national security obligation.
It would be impossible for Pakistan to invest in digitisation first, then secure. In the design and implementation of new online government services, cybersecurity should be a fundamental concern. If not, the greater the attack surface will become, the more connected the state becomes.
The opinions shared in a piece of writing are the author’s own and do not necessarily reflect the views of any organization.
The author is an intern at the Cybersecurity Program, Institute of Regional Studies, Islamabad.
Leave a Reply