A threat actor on an underground forum has claimed that a security flaw in the PULSE (Punjab Urban Land Systems Enhancement) platform allegedly exposed the database of Punjab Land Records Authority, the provincial government body responsible for managing land records in Punjab, Pakistan. The claim suggests that a broken access control issue, known as Insecure Direct Object Reference (IDOR), may have allowed unauthorised access to land registry information. However, the reported exposure has not been independently verified, and Punjab Land Records Authority has not confirmed any security incident.
According to the claim shared on the underground forum, the alleged issue affected the PULSE platform’s access controls and allowed access to a large dataset containing property-related records. The threat actor stated that the exposed information includes around 15.6 million property registry records, which were presented as a database containing approximately 16 million entries. The claimed dataset reportedly contains sensitive details such as citizens’ full names, spouse names, complete 13-digit CNIC numbers, property descriptions, property values listed in Pakistani rupees, tehsil and mauza locations, and transaction dates. The threat actor further claimed that the platform’s API did not require authentication, allowing access to registry information without proper verification. The individual also shared sample records and screenshots as alleged evidence of the claim. However, security researchers and relevant authorities have not yet publicly validated the information or confirmed whether the data originated from Punjab Land Records Authority systems. At this stage, the reported incident remains an unverified claim and should not be considered confirmation of a confirmed data breach.
If the vulnerability exists and remains unresolved, security analysts note that exposed property ownership details and national identification information could create risks for affected individuals. Data involving CNIC numbers, property details, and ownership information may be misused for identity fraud, land-related scams, targeted social engineering attempts, or fraudulent communication. Security experts emphasize that government databases containing sensitive personal information require strong access controls, authentication mechanisms, and continuous security assessments to reduce the possibility of unauthorised access. The alleged exposure also highlights broader concerns around protecting citizen information stored in digital government platforms. As public services continue shifting toward online systems, maintaining secure application programming interfaces, monitoring unusual access patterns, and regularly testing platforms for vulnerabilities remain important security measures. Organisations managing sensitive databases are encouraged to investigate reported vulnerabilities carefully and take appropriate steps if weaknesses are identified.
Punjab Land Records Authority has not issued any public confirmation regarding the alleged database exposure at the time of reporting. Further verification will be required to determine whether the claimed records are authentic, whether any unauthorised access occurred, and whether any citizen information was affected. Until official confirmation is available, the incident remains an unverified cybersecurity claim based on information shared by a threat actor.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
