Glossary term
Underground forum
An underground forum is an online community where cybercriminals advertise, buy and sell products and services, and share expertise.
Read more
Significant cyber incident
Pakistani bank card cyberattack, October 2018
The Pakistani bank card cyberattack began on 27 October 2018, when the Pakistani bank saw abnormal transactions on one of its international payment card schemes and shut the scheme down.
In short
The Pakistani bank card cyberattack began on 27 October 2018, when the Pakistani bank saw abnormal transactions on one of its international payment card schemes and shut the scheme down. The bank put the amount at Rs 2.6 million, while the payment scheme claimed about $6 million. How the card data was obtained has not been made public. The State Bank of Pakistan told all banks to guard their cards.
What happened
On the morning of 27 October 2018, the bank detected abnormal transactions on one of its international payment card schemes. In a letter to the Pakistan Stock Exchange, the bank said the transactions were worth Rs 2.6 million, and that it shut its international payment scheme as a precaution. It also said it signed out of the inter-operability switch and stopped international transactions.
The bank and the payment scheme gave different figures. The bank did not accept the roughly $6 million the international payment scheme claimed. On 21 December 2018 the Minister of State for Revenue told the Senate that hackers stole $6 million from the accounts of 6,000 of the bank’s customers within 23 minutes. He said the money taken from customer accounts was deposited back into those accounts. Sources differ on the amount: the bank says Rs 2.6 million, the scheme and the minister say $6 million.
The State Bank of Pakistan said the compromised cards were cashed out through ATM and point-of-sale machines in several countries. It told all banks to protect payment cards and watch their use in real time, especially overseas. At least six banks suspended debit card use abroad, and Pakistan Today wrote that around ten banks blocked international transactions on their cards.
In early November 2018 the head of the FIA cyber-crime wing said data from most banks had been affected. The State Bank rejected this and said only one bank had reported a breach. The public sources opened do not say how the attack was carried out.
See also the National Bank of Pakistan cyberattack of 2021, another Pakistani bank incident.
Timeline
-
27 October 2018
The bank detects abnormal transactions of Rs 2.6 million on one of its international payment card schemes and shuts the scheme.
-
27 October 2018
The Minister of State for Revenue later tells the Senate that $6 million was stolen within 23 minutes through international ATMs.
-
28 October 2018
Geo reports that the bank issued a press release saying it was the victim of a cybercrime attack. Profit dates the press release 29 October, so sources differ.
-
29 October 2018
The bank writes to the Pakistan Stock Exchange, disputes the $6 million claimed by the payment scheme, and the State Bank directs all banks to safeguard payment cards.
-
By 3 November 2018
Several banks stop international card transactions. A State Bank spokesperson says it did not ask any bank to do so and that it was each bank's own decision.
-
Early November 2018
The FIA cyber-crime director says data from most banks has been affected.
-
Early November 2018
The State Bank rejects the claim, saying there is no evidence and that only one bank reportedly had its IT security compromised.
-
Early November 2018
The State Bank says it has told all banks to identify and counter cyber threats, and that the restrictions on cards apply only to cross-border use.
-
21 December 2018
The Minister of State for Revenue tells the Senate about the $6 million and 6,000 accounts; the finance minister adds in writing that the State Bank received no data-hack complaint from any other bank.
How the attack worked
No public report opened for this page explains how the card data was obtained. The Geo report of 6 November 2018 says FIA officials had not released any information on how the attack took place. What the sources do describe is how the money moved and how the bank reacted.
Cash-out abroad
The State Bank said the compromised cards were cashed out through ATM and point-of-sale machines in several countries. The Minister of State for Revenue described the same events as theft through international ATMs. The bank itself said it saw abnormal transactions on one of its international payment card schemes.
Cutting the link
The bank shut its international payment scheme and signed out of the inter-operability switch. It said this is why it did not accept the $6 million figure claimed by the payment scheme. After the incident the bank stopped international transactions.
Claims about other banks
The FIA cyber-crime director said foreign-based hackers had breached the security systems of several domestic banks. The State Bank said it had no evidence of this. The two official views were not settled in the sources opened.
- Card data compromisedOfficials have not said how the card data was obtained.
- Cash-out abroadThe State Bank said the cards were cashed out through ATM and POS machines in several countries.
- Abnormal activity seenThe bank saw abnormal transactions on one of its international payment card schemes on 27 October 2018.
- Scheme shutThe bank shut its international payment scheme and signed out of the inter-operability switch.
Who says who was behind it
Pakistani authorities have made no public attribution and named no group.
The FIA cyber-crime director said foreign-based hackers had breached the security systems of several domestic banks (Pakistan Today, 21 December 2018). He did not name a group.
Sources differ on scope. The FIA director said data from most banks was affected; the State Bank of Pakistan said, in early November 2018, that there was no evidence of this beyond the one bank.
The US Department of Justice describes it as a North Korean-perpetrated crime: a sentencing release of 8 September 2021 for a money launderer says the funds he laundered included those from North Korean-perpetrated crimes, including the 2018 ATM cash-out theft from the bank in Pakistan. This is the DOJ's description in a sentencing release, not a finding by Pakistani authorities.
Impact
Amount: the bank reported abnormal transactions of Rs 2.6 million. The payment scheme claimed about $6 million, which the bank did not accept. The Minister of State for Revenue told the Senate on 21 December 2018 that $6 million was stolen from 6,000 accounts within 23 minutes. Sources differ.
Customers: the minister said money withdrawn from customer accounts was deposited back into the respective accounts. He also said the stolen amount was not withdrawn from anyone's bank account and described the issue as one between the commercial bank and an insurance company.
Wider effect: at least six banks suspended debit card use abroad, and Pakistan Today wrote that around ten banks blocked international transactions on their cards. The FIA said it was investigating more than 100 cases connected to the breach.
Press description: Arab News called it reportedly the biggest cyberattack in the nation's history.
Government and regulator response
- The bank, 27 to 29 October 2018: shut its international payment scheme, signed out of the inter-operability switch and stopped international transactions. It told the stock exchange it did not accept the $6 million claim. The minister told the Senate that the bank tightened its cross-border transaction procedure.
- State Bank of Pakistan, late October 2018: directed all banks to safeguard payment cards and watch their use in real time, especially overseas.
- State Bank of Pakistan, early November 2018: rejected the claim that most banks were breached, said it had told all banks to identify and counter cyber threats, and said it was working with payment schemes, operators and banks. It said the restrictions would be lifted once suitable IT security measures were in place.
- FIA: its cyber-crime director said it was investigating more than 100 cases connected to the breach.
- Government, 21 December 2018: the Minister of State for Revenue told the Senate that the State Bank had developed a road map to strengthen information security controls in banking.
Lessons
-
Agree the facts early
The bank, the payment scheme, a minister and the FIA gave different figures and scopes. A shared, checked account of what happened reduces confusion for customers and markets.
-
Be able to cut a card channel fast
The bank shut its international payment scheme and signed out of the switch straight away. Know in advance who can do this and how.
-
Watch card activity in real time
The State Bank told banks to watch card use in real time, especially overseas. Abnormal transactions on one scheme were the first sign.
-
Regulator and law enforcement must share one line
The FIA and the State Bank gave opposite views on how many banks were affected within days of each other.
-
Customers need clear steps
Many banks blocked overseas use of debit cards. Tell customers what is blocked, why and when it ends.
-
Publish what you can about the method
Officials had not said how the attack took place, which leaves other banks guessing what to fix.
What to check in your own organization
-
Overseas card controls
Check whether you can switch off international card use by scheme, by country or by card type within minutes, and who may approve it.
-
Real-time monitoring
Check that card transactions are monitored around the clock and that abnormal volume on one scheme raises an alert to a named person.
-
Switch connectivity
Check that you can disconnect from a payment switch or international scheme quickly and test that procedure.
-
Reconciliation with the scheme
Check how you reconcile your own transaction records with what the scheme reports, so that you can explain any gap such as Rs 2.6 million against $6 million.
-
Customer reimbursement
Check the process for returning money to customers and the insurance cover for card fraud.
-
Regulator and police contacts
Check that your bank has one agreed message for the central bank and the cyber crime agency before you speak publicly.
-
Dark web card sales
Check whether your own card numbers appear for sale on criminal forums and what you do when they do.
Where it happened
- Industry Financial services Phishing pages, stolen customer logins, card data for sale and supplier exposure, and the rules that apply to banks, payment firms and insurers.
- Country Pakistan Pakistan appears in MITRE ATT&CK and US government texts as a target of South Asian and Chinese espionage groups and as one of the nations a North Korean bank-robbing team likely targeted. Asia Pacific
Questions
How much money was lost at the bank?
Sources differ. The bank said transactions were worth Rs 2.6 million and did not accept the roughly $6 million claimed by the international payment scheme. The Minister of State for Revenue told the Senate that $6 million was stolen from 6,000 accounts within 23 minutes.
Did customers lose money?
The minister said money withdrawn from customer accounts was deposited back into the respective accounts, and that the stolen amount was not withdrawn from anyone's bank account.
Were other banks hacked?
The FIA cyber-crime director said data from most banks was affected. The State Bank of Pakistan said there was no evidence of this and that only one bank had reportedly been compromised. Around ten banks blocked international card use as a precaution.
How did the attackers get the card data?
The public sources opened do not say. FIA officials had not released information on how the attack took place.
Who was behind it?
No public attribution. The FIA director spoke of foreign-based hackers but named no group.
Where do these facts come from?
From the bank's statements, State Bank statements, a Senate reply reported by the Associated Press of Pakistan, and reports by Geo, Arab News and Pakistan Today. The State Bank and FIA websites could not be opened for this page.
Sources
- BankIslami confirms it's a victim of $6mn cyberheist (29 October 2018) Arab News Pakistan
- Possible fraud causes banks to disable int'l ATM transactions (3 November 2018) Profit by Pakistan Today
- Over 19,000 card details from 22 Pakistani banks stolen in cyber-security breach (6 November 2018) Geo News
- SBP rejects FIA claim of data theft from 'almost all' Pakistani banks (7 November 2018) Geo News
- BankIslami lost $6m within 23 minutes in cyber attack (21 December 2018) Pakistan Today
- Bank of Islami's $ 6 mln stolen within 23 minutes, Senate told (21 December 2018) Associated Press of Pakistan
- SBP clarifies: except for one, no evidence of banks data being hacked (press release, 6 November 2018) State Bank of Pakistan
- International Money Launderer Sentenced to over 11 Years in Federal Prison for Laundering Millions from Cyber Crime Schemes (8 September 2021, archived copy) US Attorney's Office, Central District of California (US Department of Justice)
- International Money Launderer Sentenced to over 11 Years in Federal Prison for Laundering Millions from Cyber Crime Schemes (8 September 2021, original page) US Attorney's Office, Central District of California (US Department of Justice)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.