Pakistan Bank Data Breach: 7 Mistakes Behind the 2018 Card Dumps

Did hackers really break into almost every bank in the country during the Pakistan bank data breach of late 2018? That was the claim one senior official made on television, and the central bank rejected it the same day. The record that survives is narrower, and in some ways more useful: stolen card data, a 23-minute cash-out abroad, and a list of weak spots that you can still check today.

This case study takes the "what went wrong" approach. Instead of retelling the story once, it walks through the seven gaps that let it happen and what changed afterwards. In this post you will find:

• A dated timeline of the card dumps, the BankIslami cyber attack and the official responses
• Why the figures ranged from Rs. 2.6 million to $6 million, and which ones are confirmed
• Seven specific mistakes, each linked to the rule the regulator later added
• Who was blamed, and why no attacker has been publicly named
• Numbered steps for cardholders and small businesses in Pakistan

What Was the Pakistan Bank Data Breach of 2018?

It was not one break-in. It was a wave of stolen payment card data that surfaced for sale between late October and mid-November 2018, alongside a fraud attack on one bank. Security firm Group-IB tracked three uploads of Pakistani card records to Joker's Stash, a large underground card shop at the time. These dark web card dumps were sold in bulk, priced per card.

The records were "dumps." In plain terms, a dump is a copy of the data held on a card's magnetic stripe. Criminals buy dumps because the stripe data can be written onto a blank card and used where stripe payments still work. That is why most of the money left through ATMs and shops outside Pakistan.

Two facts are confirmed by named parties. First, BankIslami lost money on 27 October 2018, which it disclosed to the stock exchange. Second, large card dumps tied to Pakistani banks were on sale. The claim that hackers got inside "almost all" bank systems was never confirmed, as the sections below explain.

Timeline: From the First Dump to New Card Rules

Dates below are in Pakistan time. Exact clock times were rarely published, so only one is shown.

How Did the Attack Work, in Plain Language?

Card fraud of this kind usually has three stages. You do not need technical detail to follow them, and defenders think about them in the same order.

1. Collection. Card data is captured somewhere in its normal life. Group-IB says dumps usually come from card skimming devices or from malware on computers linked to point-of-sale terminals. It suggested this kind of POS malware "might have caused" the leak, which is a hypothesis, not a finding.
2. Sale. The data is bundled and sold on a card shop. The Pakistani bundles were labelled as mixes of Pakistani, world and European cards.
3. Cash-out. Buyers copy the data onto cards and withdraw cash or buy goods abroad, often in a short, coordinated burst before the bank notices.

Geo News reported that PakCERT and other experts believed the data came from skimming rather than a direct break-in to bank servers, mainly because so many banks appeared in the lists. A single server breach rarely touches 22 banks at once. A skimmer at a busy ATM or a compromised shop terminal can.

Money and Data: What Was Actually Lost?

The numbers in coverage varied widely. Here is what each figure refers to.

BankIslami's Losses

Dawn reported that BankIslami put its own loss at Rs. 2.6 million and returned that money to the affected accounts. Early local reports said about $6 million. The bank's explanation was that the international payment scheme recorded $6.1 million in transactions, but those were never processed by the bank's system or charged to customers.

In December, Minister of State Hammad Azhar told the Senate that $6 million had been taken from about 6,000 BankIslami customers in 23 minutes, according to Profit. He also said no money was withdrawn from customer accounts and the matter was between the bank and an insurer. So the two figures describe different ledgers: the bank's own loss, and the wider value cashed out against its cards.

Card Records on Sale

Group-IB counted 10,467 cards in the 26 October dump and 11,795 on 31 October. The 13 November upload held 177,878 cards, of which 150,632 were from Pakistani banks. It estimated that last batch's market value at $19.9 million, with asking prices from $17 to $160 per card.

Across all three uploads, that comes to roughly 200,000 card records. PakCERT's figure was 19,864 cards from 22 banks, which covers the first two dumps only. That is why some outlets wrote "about 20,000 cards" and others wrote "170,000." Both were correct for different dates.

The 7 Mistakes That Let It Happen

None of these gaps belonged to one bank alone. Most were common across the sector, which is why the regulator's later circular addressed nearly all of them by name. Each mistake below is matched to that fix.

Mistake 1: Cards That Could Still Be Cloned

A dump is only valuable while the stripe data works somewhere. An EMV chip card creates fresh transaction data each time it is used, which makes a copied stripe far less useful. On 28 November, the State Bank ordered banks to replace existing payment cards with EMV chip card and PIN versions by 30 June 2019, Dawn reported. That deadline shows the move to chip was not finished in 2018.

Mistake 2: Overseas Use Switched On by Default

Most stolen value left the country through cards that worked abroad by default. The fix the regulator chose suggests many customers had no easy way to turn that off. The same circular gave banks until 31 March 2019 to let customers switch online and cross-border use on or off themselves.

Mistake 3: No Sensible Ceiling on Cross-Border Spending

The Senate figure of $6 million in 23 minutes describes a burst, not a slow leak. Daily limits for cross-border use, agreed in advance with the payment schemes, cap how much a burst can take. The circular told banks to set them immediately.

Mistake 4: Customers Were Not Told About Every Transaction

If you get an SMS for each card payment, you become an early warning system for your own account. From 1 January 2019, banks had to send free SMS and email alerts for all digital transactions, local and international.

Mistake 5: Detection Came From Outside

A BankIslami official told Dawn the bank was alerted through an advisory from an international payment scheme. In-house monitoring did not raise the first flag. The State Bank later required real-time fraud monitoring tools by 31 January 2019, plus round-the-clock watching of card and internet banking activity.

Mistake 6: Two Agencies, Two Stories

On 6 November, FIA cybercrime director Mohammad Shoaib said data from "almost all" banks was hacked, then softened it to "most of the banks," Dawn reported. The State Bank of Pakistan "categorically" rejected the claim and said no bank or agency had given it such evidence. Its spokesperson added that verifying a dump would mean buying it. For customers, the result was confusion at the exact moment clear instructions mattered most.

Mistake 7: No Clock on Disclosure and Refunds

The FIA said some banks hid thefts and that victims went to their bank, not to investigators. Before the circular, no fixed deadline told banks how fast to inform or repay you. Afterwards, banks had to inform affected customers within 48 hours and compensate losses within two business days.

Who Was Behind It, and How Sure Can Anyone Be?

No person or group has been publicly named for collecting or selling these dumps. That is a key difference from cases like the Bangladesh Bank heist or the Ronin Network hack, where US authorities linked the attacks to North Korean groups.

Here is how the claims line up, from firmest to weakest:

• Confirmed: BankIslami suffered unauthorized international transactions on 27 October. Dumps listing Pakistani cards were sold on Joker's Stash.
• Expert assessment: The data most likely came from skimming or POS malware, not from bank servers. Group-IB and PakCERT both leaned this way.
• Official claim, unproven: The FIA said foreign-based hackers breached most banks. The State Bank, MCB and Sindh Bank all said customer data was safe.
• Insider theory, unproven: A senior banker told Profit the BankIslami case might involve internal fraud. Researcher Rafay Baloch did not rule out a server breach either.

So treat attribution here as low confidence. The method is reasonably understood. The people behind it are not.

What Happened Afterwards?

The FIA said it was looking into more than 100 cases. When its team met State Bank officials on 8 November, it shared details of about 1,576 banking fraud complaints filed that year. We found no public report of charges linked to the dumps themselves.

The lasting change came from the regulator. The 28 November circular also required penetration testing of card, SWIFT, RTGS, internet and branchless banking systems, an independent audit by the end of 2019, and a review of contracts with payment schemes.

For many people, the visible result was a new chip card in the post and an SMS for every payment. Those two changes are now so normal that it is easy to forget they followed this incident.

What Does This Mean for You in Pakistan?

The Pakistan bank data breach shows that your card data can be stolen at a terminal you trusted, with no hacking of your bank at all. You cannot inspect every ATM. You can, however, control what a copied card is allowed to do.

For small shops and online stores, the lesson is about the terminal and the computer next to it. Group-IB named malware on computers linked to POS terminals as a major source of dumps, so the PC beside your card machine matters as much as the machine.

The wider pattern links to other posts in this series. The Binance hack and the Bybit hack also show how quickly stolen value moves once attackers get access. Fraud also reaches people by phone: see our guide to fraud calls in Pakistan, because callers posing as bank staff often ask for the very codes that alerts would send you.

Defensive Lessons: What Should Cardholders and Businesses Do?

These steps turn the seven mistakes behind the Pakistan bank data breach into habits. Most take minutes.

1. Turn off international and online use in your banking app when you do not need it. Switch it on only for a trip or a planned purchase.
2. Set your own daily limit lower than the bank's default, especially for cross-border use.
3. Keep your mobile number current with your bank so that every transaction alert reaches you.
4. Read each alert. If you see a payment you did not make, block the card in the app first, then call the number printed on its back.
5. Report fraud to your bank in writing and keep the complaint number. Under the 2018 rules, banks must compensate confirmed losses within two business days.
6. Look at the card slot before you use an unfamiliar ATM. Cover the keypad while you type your PIN.
7. Shop owners: keep POS terminals on their own network, never on the PC used for email and browsing, and update both.
8. Never share a one-time code with a caller, even one who knows your card number. Real bank staff will not ask for it.

Where PSTA Students Meet Cases Like This

The Pakistan bank data breach makes a strong teaching case because card fraud sits where technology, process and law meet. PSTA's beginner-level Cyber Security and Ethical Hacking course lasts 12 weeks. It moves from the CIA triad and risk to common attacks such as social engineering, then to firewalls and intrusion detection, malware, threat detection, digital forensics and cyber law.

In that course, an incident like this becomes a structured exercise. You build a timeline from public reports, separate confirmed facts from claims, and write findings a manager could act on. Classes run on campus in Abbottabad or live online, with a new batch each month.

Students who finish the foundations and want to practice offensive testing, legally and only with permission, can move on to our Advanced Ethical Hacking and Penetration Testing program at intermediate level.

Ten Minutes With Your Banking App Today

The Pakistan bank data breach is now eight years old, but its lesson is still current: a copied card can only spend what you let it spend. Open your banking app today, find the card controls, and switch off international use if you are not travelling. If you would like to study incidents like this properly, our team can tell you about the next cyber security batch on WhatsApp or at the Abbottabad campus.