Pakistani law enforcement cyberattacks linked to hacking groups associated with China and India targeted several police and public security agencies between February 2024 and April 2026, according to a cybersecurity report.
The report said the campaigns focused on institutions that hold sensitive information about Pakistan’s internal security, including data related to militant violence, policing operations, identity-linked records and the country’s security posture in regions affected by unrest.
Balochistan Police was identified as the most prominent target. Other affected or targeted organisations included Khyber Pakhtunkhwa Police, Islamabad Police and the Punjab Safe Cities Authority, which operates security and policing systems in major cities in Punjab.
The findings point to a growing cyber dimension in South Asian security competition, where law enforcement databases and public-facing police systems can become intelligence targets for foreign-linked actors.
Pakistani law enforcement cyberattacks centred on Balochistan Police
Pakistani law enforcement cyberattacks were concentrated most heavily on Balochistan Police, according to the cybersecurity firm behind the report. The affected systems included network appliances and web servers hosting applications used for policing functions and public interaction.
The report said some of the affected applications contained or connected to sensitive law enforcement data, including criminal records, biometric records, police personnel information, hotel and tenant registration systems and citizen complaints.
One of the most significant findings involved the Balochistan Police Complaint Management System. The report said a suspected China-linked actor compromised the application and placed implants that appeared to be disguised as portal updates.
This is important because the complaint system is used by both police personnel and citizens. If successfully exploited, such a compromise could expose internal police users, members of the public filing or tracking complaints, and the wider network environment connected to the application.
The report said the use of a public-facing police portal as a malware delivery point widened the potential surveillance surface beyond government systems alone.
China-linked and India-linked activity reported
The report attributed different parts of the activity to suspected China-linked and India-linked groups, while also noting that some tools used in the campaigns are shared or commercially available.
China-linked activity was assessed as likely connected to Beijing’s interest in the safety of Chinese nationals in Pakistan. Chinese workers and engineers have repeatedly been targeted in attacks, particularly in areas linked to infrastructure projects and the China-Pakistan Economic Corridor.
The report said China may have an incentive to assess Pakistan’s internal security situation independently, especially in Balochistan, where militant groups have attacked Chinese interests in the past.
India-linked activity, according to the report, was likely connected to the broader rivalry between India and Pakistan. Balochistan has long been a sensitive province in that relationship, with Pakistan accusing India of supporting separatist activity, a charge India has denied.
The report did not establish direct responsibility by either government. It described the activity as linked to groups associated with China and India, based on tooling, infrastructure, victimology and other technical indicators.
Police systems hold high intelligence value
The targeting of police agencies reflects the intelligence value of law enforcement systems. Police databases can reveal how a state understands domestic threats, which individuals are being monitored, where operations are taking place and how authorities respond to unrest or militant activity.
In Balochistan, such information is especially sensitive. The province is affected by separatist violence, attacks on security forces and repeated threats to infrastructure and foreign nationals. It is also strategically important because of Gwadar, mineral resources and projects linked to Chinese investment.
The report said Balochistan Police systems may have contained data on criminal cases, biometric records, hotel check-ins, tenant registrations, vehicle theft records, police personnel and citizen complaints. If accessed by hostile actors, such data could be valuable for surveillance, intelligence gathering or further intrusions.
The same concern applies to other law enforcement bodies. Khyber Pakhtunkhwa Police operates in a province affected by militant violence and cross-border security concerns, while the Punjab Safe Cities Authority manages urban surveillance and command systems.
KP Police says core systems not compromised
Khyber Pakhtunkhwa Police said the security of its systems was a matter of the highest priority and that there was no evidence any core system, network or critical application had been successfully compromised.
The agency acknowledged that attempted cyber activity increased during heightened Pakistan-India tensions last year. It also said that in one isolated incident, the login credentials of an end user were compromised.
The distinction is important. Attempted intrusions, credential theft and full compromise of critical systems are different levels of cyber risk. The police statement indicates that KP Police rejected the suggestion of a successful compromise of core infrastructure, while acknowledging that cyber activity had increased and that one user credential had been affected.
Balochistan Police did not respond to requests for comment cited in the report. Islamabad Police, the Punjab Safe Cities Authority and Pakistan’s Ministry of Interior also did not respond to requests for comment.
China denies involvement in cyberattacks
The Chinese Embassy in Washington denied involvement in cyberattacks. Its spokesperson said China opposes and combats all forms of cyberattacks under the law and does not allow any country or individual to conduct illegal activity from Chinese territory or through Chinese infrastructure.
The Indian Embassy in Washington did not respond to questions about the analysis.
The denials and lack of comment underline why attribution in cyber cases must be handled cautiously. Cybersecurity firms often rely on technical evidence, infrastructure overlaps, malware families, targeting patterns and historical behaviour, but such findings do not always amount to conclusive proof of state direction.
That is why the report’s language is significant. It refers to suspected China-nexus and India-nexus actors rather than direct official responsibility.
Digital policing creates new risks
The report highlights a broader problem for Pakistan cybersecurity: as police systems become more digital, the value of compromising them increases.
Digital policing can improve public access, case management, identity checks and coordination between agencies. However, it can also centralise sensitive records in systems that become attractive targets for espionage.
Public-facing portals are particularly vulnerable if not properly secured. They must be accessible to citizens, but they may also connect to internal databases or administrative systems. If attackers compromise such portals, they may gain a foothold for deeper access.
This creates a serious governance challenge. Law enforcement agencies need modern digital systems, but those systems must be protected through strong access controls, patch management, network segmentation, monitoring, incident response and regular security audits.
The alleged compromise of the Complaint Management System shows how a platform designed to improve police access and accountability can be turned into an attack surface if security controls fail.
Cybersecurity now part of regional security
The Pakistani law enforcement cyberattacks reported by researchers show that regional security competition is no longer limited to borders, diplomacy or conventional intelligence activity.
Cyber operations allow states and state-linked groups to gather information quietly, test systems and exploit weak points without direct confrontation. Police agencies, because of the type of information they hold, are natural targets in this environment.
For Pakistan, the findings should raise concern not only about foreign-linked cyber activity, but also about the security of public-sector digital infrastructure. Police agencies, identity-linked databases, complaint portals and urban surveillance platforms all require stronger protection because they contain information about citizens, officers and ongoing security operations.
The report also shows that Pakistan’s partners and rivals may have different reasons for targeting similar systems. China-linked actors may be interested in threats to Chinese nationals and projects, while India-linked actors may seek insight into Pakistan’s security posture.
The result is the same for Pakistan: law enforcement infrastructure has become intelligence terrain.
Pakistan needs stronger public-sector cyber defences
The latest report should prompt a wider review of cybersecurity across police and internal security institutions. That review should focus on systems that store sensitive records, interact with citizens or connect to national identity and surveillance databases.
Priority measures should include independent security audits, faster patching of exposed systems, stronger credential controls, incident reporting rules, forensic readiness and centralised support for provincial police departments that may lack advanced cyber capacity.
Pakistan also needs clearer public communication after cyber incidents. Agencies should be able to distinguish between attempted attacks, credential theft, limited compromise and breach of critical systems. Without that clarity, public trust can be weakened and misinformation can spread quickly.
The reported campaigns show that police data is not only an administrative asset. It is a national security asset. Protecting it requires investment, technical expertise and coordination between law enforcement, cybersecurity agencies and government departments.
For now, the report’s central finding is clear: Pakistani law enforcement agencies have become targets for foreign-linked cyberespionage, with Balochistan Police at the centre of the activity. The allegations remain subject to official responses and further verification, but they underline a serious vulnerability in Pakistan’s digital security landscape.
Published in SouthAsianDesk, July 10, 2026
Follow SouthAsianDesk on X, Instagram and Facebook for insights on business and current affairs from across South Asia.
