On 3 November 2026 the Night Hunters hacktivist group posted a claim on Telegram about Jamiat Ulema-e-Pakistan, a Pakistani political party. The post says the group compromised systems linked to the party and reportedly reached membership records spanning the past 10 years. Every element below is the group’s claim; we have not verified any of it.
What makes the post worth explaining is its closing line: a sample for verification, and the full dataset “exclusively to the relevant authorities”. This article sets out what the group says, what our own data shows about the group, and why that wording matters for privacy. It takes no side in the dispute between India and Pakistan that the group cites.
- Post created_at.
- 3 November 2026, 17:19 UTC (Brandefense Blackhole recorded it within seconds).
- Group.
- Calls itself Night Hunters.
- Named party.
- Jamiat Ulema-e-Pakistan, a Pakistani political party.
- Group’s stated reason.
- The party’s “alleged anti-India activities”.
- Claimed access.
- Systems “associated with the organization” and membership-related records “reportedly spanning the past 10 years”.
- Claimed next step.
- A sample “for verification”, then the full dataset to “the relevant authorities”.
- Attached to the post.
- One image file, which we have not opened.
What Is a “Hand It to the Authorities” Claim?
It is a claim in which the group says it will not sell or publish what it took, but pass it to officials. The framing presents the act as a hand-over rather than a sale. It is a way of presenting an intrusion, not evidence that one happened.
- Hacktivist groupA group that attacks or leaks for a political cause rather than for payment.
- Membership recordsLists of people who joined an organisation, which may hold names, contact details and addresses.
- SampleA small part of the data posted to show that the rest exists; it proves little until someone checks it.
- AuthoritiesThe officials the group says will receive the data; the post does not name any.
The same post makes three separate statements: that systems were reached, that records were taken, and that officials will receive them. Only the party or its hosting providers could test the first two; nothing in the post lets a reader test any of the three. The third is a promise about the future, and nothing in the post lets a reader test it.
- Systems compromisedClaimstated in the post
- Membership records reachedClaimstated in the post
- Sample to be releasedProofpromised; no sample in our data
- Full set to authoritiesHand-over
What Does Our Blackhole Data Show About Night Hunters?
We searched Brandefense Blackhole for the phrase “Night Hunters” in posts inserted since 1 August 2026. It returned 19 distinct posts from 7 channels. Only 9 of them were written under the group’s own name; the other 10 are not the same group and are left out of the counts below.
Seven of the 10 are adverts, created between 13 and 23 October, for a mailbox tool called Night-Hunter. The name is unrelated. One more is a short message that mentions a “night hunter” account name and is not a claim, and one carries the title of a third-party report about the group. One more is a repost of a doxing claim aimed at the group; we use nothing from it.
Of the group’s 9 posts, 7 were created in August 2026, 1 on 4 September and 1 on 3 November. None was created in October. We give created_at dates throughout, which are the dates on the posts. Blackhole’s seen and inserted times for the same posts fall within about a minute of them.
| Month | Posts under the group's name | What they say |
|---|---|---|
| August 2026 | 7 | Four claims on 15 August, two ownership and contact posts on 17 August, one Indian Independence Day greeting on 14 August |
| September 2026 | 1 | A post on 4 September about “future ops”: recruiting members and targeting social media and individuals “against India” |
| October 2026 | 0 | No post under the group’s name in our results |
| November 2026 | 1 | The Jamiat Ulema-e-Pakistan claim of 3 November |
Is the New Claim Part of a Pattern?
The August claims were all posted on 15 August. Three name Pakistani targets: a national weather service, a large list of routers and a domain registration account of another Pakistani political party. The fourth names a meteorological body in Bangladesh, posted as a joint operation with another group.
Two of those posts put material straight into the text: a portal login in one, and a password line in the other. The party-domain post lists contact details that we do not repeat. The 3 November post differs: its text shows no material and promises a sample later. We have not tested any of the claimed access, so we cannot say whether the earlier posts were genuine.
The group’s own wording points at India. Its 14 August post describes the members as “Indian Hacktivists”, and its September post names people “against India” as targets. That is how the group describes itself, and we record it without comment on the wider dispute.
Why Does the “Authorities” Wording Matter?
Groups that sell or dump data usually ask for money or attention. A group that says it will give the data to officials is claiming a different role, different from a seller or a leaker. Our reading, and only our reading, is that this wording suggests a state-aligned posture, meaning a group that aims to serve or please officials on one side of a conflict.
We cannot show that from the post. The wording could equally be a way to gain credibility, to avoid the legal risk of publishing personal data, or to attract attention. We attribute the activity to no government, and nothing in our data names one.
What Is the Privacy Risk for Members?
Membership records can hold names, phone numbers, email and home addresses, and the fact of belonging to a religious or political body. In the wrong hands that fact can lead to harassment or worse, in any country. If the records are real, handing them to “authorities” does not remove the risk: the data still exists outside the party’s control and can be copied.
A sample is a second risk. Even a small sample can expose real people, and once posted it can be copied and re-shared. Anyone who finds such a sample should not forward it; that is our reading of good practice. The steps in data breach response basics apply to the organisation.
What Should Political Organisations Do?
These steps are our advice and apply whether or not this claim proves true. Political bodies, charities and religious organisations are attractive to hacktivists because their member lists matter to the people on them. For the wider picture of how such groups work, see our report on hacktivism and DDoS trends.
- Check your own systems firstReview logins, admin accounts, hosting and domain panels for the time of the claim before replying to anyone.
- Find where member data livesList every system that holds member records, including old exports, mailing tools and volunteer spreadsheets.
- Reduce what you keepDelete or archive old records you no longer need; ten-year-old lists are the largest risk.
- Prepare membersTell members, once you know more, to watch for phishing and unwanted contact that uses their membership details.
- Keep the evidenceSave the post text and dates and do not open or share the group’s own files or links.
If records are confirmed taken, the organisation should treat it as a data breach and follow its legal duties in its own country. Data copied out of a network is data exfiltration; our glossary entry on data exfiltration explains how it is spotted.
What Is Still Unknown?
We do not know whether any system was reached, whether the records exist, or whether the promised sample will appear. The party is the one that can confirm or deny the claim, and we will update this article if it does. Until then the post is a claim, nothing more.