Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
National Bank of Pakistan cyberattack, October 2021
In short
The National Bank of Pakistan cyberattack hit the servers of the state-owned bank on the night of 29 October 2021 and disrupted some services, delaying payments to thousands of public sector employees. The bank and the State Bank of Pakistan said no customer or financial data was compromised and no financial loss was seen. The public sources opened do not say who was behind it or what type of attack it was.
What happened
The National Bank of Pakistan (NBP) said that in the late hours of 29 October 2021 and the early morning of 30 October a cyber-attack on its servers was detected and affected some of its services. It said immediate steps were taken to isolate the affected systems. The bank is described as Pakistan’s leading financial institution, with 1,512 branches in the country and 21 overseas branches.
The State Bank of Pakistan confirmed on 30 October that NBP had reported a cybersecurity-related incident that was being investigated. It said NBP had not observed any data breach or financial loss and that no other bank had reported such an incident. Daily Pakistan reported that payments were delayed on Saturday for thousands of public sector employees after hackers targeted a section of the bank.
NBP told its customers on 31 October that their financial data had not been compromised, and that it had countered the threats and repaired the affected parts of its systems. It said ATMs and the payment of salaries and pensions would be possible again on 1 November 2021. Gulf News reported that the bank restored all banking services on that date.
The nature of the attack was not confirmed. Gulf News wrote that it was not confirmed whether it was ransomware, a data breach or a DDoS attack. Unnamed NBP sources told ARY News that the system suffered a malware attack. Sources differ on whether other banks were hit: the State Bank said no other bank reported an incident, while an NBP message to staff, reported by Profit, spoke of hacking attempts that affected other banks as well.
See also the Pakistani bank card cyberattack of 2018, another Pakistani bank incident.
Timeline
-
Late 29 October 2021
A cyber-attack on NBP's servers is detected, and affected systems are isolated.
-
30 October 2021
The State Bank of Pakistan says NBP reported a cybersecurity incident under investigation, with no data breach or financial loss observed and no other bank affected.
-
30 October 2021
NBP says its services to customers are disrupted and expects essential services back by Monday morning. Payments are delayed for thousands of public sector employees.
-
By 1 November 2021
Unnamed NBP sources tell ARY News that the system suffered a malware attack and had not been restored.
-
31 October 2021
NBP says its customers' financial data has not been compromised and that it has repaired the affected parts of its systems.
-
31 October 2021
The payment switch 1LINK says interoperable banking services were not disrupted.
-
1 November 2021
NBP says ATMs and salary and pension payments will be possible again; Gulf News reports that all banking services were restored.
-
1 November 2021
NBP's own press release says more than 1,000 branches operated and processed 800,000 transactions of over Rs 286 billion, and all ATMs were available for withdrawals.
-
1 November 2021
The FIA calls on NBP, notes no personal data or monetary theft, and warns account holders to beware of calls from possible hackers.
-
About two months earlier
Profit notes that the data center of the Federal Board of Revenue was hit by a cyber-attack.
How the attack worked
The public accounts of this incident are short and do not describe the method. NBP did not disclose the type of attack, and Gulf News wrote that it was not confirmed whether it was ransomware, a data breach or a DDoS attack. This page therefore states only what officials, the bank and press reports said.
What was hit
NBP said the cyber-attack hit its servers. Profit reported that a section of the computer system was affected. A senior NBP official told the press that the hackers failed to gain access to the main servers, though they took control of some of the computers. In a message to staff, NBP management said core banking had not been affected.
What it did to services
Payments to thousands of public sector employees were delayed. Unnamed NBP sources told ARY News that tax collections and pension payments were among the services hit, and that the banking system had suffered a malware attack. These sources were not named and differ in detail from the bank’s own statements.
Containment and recovery
The bank isolated the affected systems and, with specialist partners, worked for 48 hours to repair them. It said services would return on 1 November.
- Hackers reach NBP systemsThe method is not published. NBP said a cyber-attack on its servers was detected on 29 and 30 October 2021.
- Some computers taken overA senior NBP official said the hackers did not reach the main servers but took control of some computers.
- Services disruptedPayments to thousands of public sector employees were delayed, and NBP said some services were impacted.
- Systems isolatedNBP said immediate steps were taken to isolate the affected systems.
- Services restoredNBP said it repaired the affected parts of its systems and services returned on 1 November 2021.
Who says who was behind it
No public attribution. No group or individual is named in the sources opened. ARY News quoted unnamed NBP sources describing "a cyber-attack late last week by an unknown source".
Sources differ on the type of attack: Gulf News wrote that it was not confirmed whether it was ransomware, a data breach or a DDoS attack, and unnamed NBP sources told ARY News it was a malware attack.
Impact
Services: some NBP services were disrupted from 29 to 30 October 2021, and payments to thousands of public sector employees were delayed. Unnamed NBP sources told ARY News that tax collections and pensions were among the services hit. ATMs and salary and pension payments were due back on 1 November.
Data and money: NBP and the State Bank of Pakistan said no customer or financial data was compromised and no financial loss was observed. The FIA noted no personal data or monetary theft after calling on the bank. These are statements by the bank and officials.
Other banks: the State Bank said no other bank reported an incident; 1LINK said interoperable banking services were not disrupted. An NBP message to staff spoke of hacking attempts affecting other banks as well. Sources differ.
Government and regulator response
- NBP, 30 to 31 October 2021: isolated the affected systems, worked with specialist partners for 48 hours, said it had countered the threats and repaired the affected parts, and set 1 November for the return of ATMs and salary and pension payments.
- State Bank of Pakistan, 30 and 31 October 2021: confirmed the incident was being investigated, said it saw no data breach or financial loss and no incident at other banks, and said it was monitoring the situation closely.
- 1LINK, 31 October 2021: said interoperable banking services such as ATM withdrawals and inter-bank transfers were not disrupted.
- FIA, 1 November 2021: called on NBP, noted no personal data or monetary theft, and told account holders not to share private details with anyone claiming to be an NBP official.
- NBP, 2022: its Annual Report 2022 says expert cyber security consultants were engaged to contain the damage and set up an incident response posture, and that major steps were taken during 2022 to strengthen IT network and system security.
Lessons
-
A state bank is a national dependency
Delayed pay for thousands of public sector employees shows how one bank's outage becomes a public problem.
-
Say what you know and what you do not
The bank gave early statements that data was safe, while the attack type was never confirmed. Clear wording about what is known helps trust.
-
Have a plan for calls and scams after an incident
The FIA warned account holders to beware of calls from possible hackers asking for private details.
-
Isolate first
NBP said immediate steps were taken to isolate the affected systems, and it stated that core banking was not affected.
-
Agree one line on other banks
The State Bank said no other bank reported an incident, while an NBP staff message spoke of industry-wide attempts. Align messages across the sector.
-
Test recovery for payroll and pensions
Recovery was announced around salary and pension payments, which shows what customers and government need first.
What to check in your own organization
-
Isolation switches
Check that you can cut affected servers and network segments from the rest of the bank within minutes, and who may decide.
-
Payroll and pension dependencies
Check which government and payroll payments depend on your systems and set a recovery order that puts them first.
-
Branch and remote-desktop systems
Check how branch servers and virtual desktops are restored in a crisis, and that you rehearse it.
-
Core banking separation
Check that core banking is separated from office networks, email and apps, and test that separation.
-
Outside specialists
Check that a forensic and recovery partner is under contract so you do not start procurement during the incident.
-
Customer scam warnings
Check that you can send a warning about phone and message scams to customers within hours of an incident.
-
Sector contacts
Check that you have contacts at the central bank, the national CERT, the cyber crime agency and the payment switch, and that they have yours.
Where it happened
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
- Country Pakistan Pakistan appears in MITRE ATT&CK and US government texts as a target of South Asian and Chinese espionage groups and as one of the nations a North Korean bank-robbing team likely targeted. Asia Pacific
Questions
When did the National Bank of Pakistan attack happen?
NBP said the cyber-attack on its servers was detected in the late hours of 29 October 2021 and the early morning of 30 October 2021.
Was customer money or data lost?
NBP and the State Bank of Pakistan said no customer or financial data was compromised and no financial loss was observed. The FIA also noted no personal data or monetary theft. These are statements by the bank and officials.
What kind of attack was it?
It was not confirmed. Gulf News wrote that it was unconfirmed whether it was ransomware, a data breach or a DDoS attack. Unnamed NBP sources told ARY News it was a malware attack.
When were services back?
NBP said ATMs and salary and pension payments would be possible again on 1 November 2021. Gulf News reported that all banking services were restored on that date.
Were other banks hit?
Sources differ. The State Bank said no other bank had reported such an incident. An NBP message to staff spoke of hacking attempts affecting other banks as well.
Who was behind it?
No public attribution. The sources opened name no group.
Sources
- Pakistan's National Bank assures customers data safe after cyberattack (1 November 2021) Arab News Pakistan
- National Bank of Pakistan confirms cyberattack but says no data compromised (1 November 2021) Gulf News
- No disruption in digital banking services post cyber attack on NBP (31 October 2021) Profit by Pakistan Today
- Cyberattack hits National Bank, causes countrywide disruption of services (31 October 2021) Daily Pakistan
- National Bank of Pakistan suffers cyber attack (30 October 2021) ARY News
- Don't share private data with anyone, FIA warns NBP account holders (1 November 2021) ARY News
- NBP reports continuing successful operational recovery from the cyber-attack (press release, 1 November 2021) National Bank of Pakistan
- Annual Report 2022, IT Network and System Security National Bank of Pakistan
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.