A massive data breach in Pakistan exposed the personal information of thousands of citizens, including federal ministers, senior officials, and employees of government agencies like the Pakistan Telecommunication Authority (PTA). Sensitive data—such as national ID copies, call records, SIM ownership details, mobile location histories, and international travel information—was leaked and sold online at minimal prices (e.g., location data for ~$1.76, call records for ~$7). The breach compromised high-profile figures, including Interior Minister Syed Mohsin Naqvi, whose data was advertised on Google. Hostile actors could weaponize this data for surveillance, blackmail, or hybrid warfare, posing risks to national security, public trust, and institutional credibility. The incident follows prior breaches, including the theft of 180 million user credentials (2023) and 2.7 million personal records (2019–2023) from NADRA. The government launched a federal inquiry, but systemic vulnerabilities—lack of a robust data protection authority, inadequate cybersecurity frameworks, and persistent illegal trade of citizen data—remain unaddressed. The breach undermines Pakistan’s digital transformation efforts and exacerbates risks in a region plagued by terrorism, political instability, and foreign surveillance.