Cybersecurity breach at NIFT puts national security at risk

Negligence and system failure expose 67.5 million customers’ data

KARACHI:

Pakistan’s national security has once again been compromised due to negligence at the National Institutional Facilitation Technologies (NIFT). Cyber attackers managed to breach the security of the cheque clearing institution, gaining unauthorised access to data and forcing the banking system to resort to a manual system despite the prevalence of digital technology.

Even after seven days since the cyberattack occurred last week, NIFT is still in the process of fully restoring its normal operations. Cheques are being cleared manually nationwide, and digital payment services remain halted.

Last Friday (June 16), the attack forced the national institution to shut down both its data centres in Islamabad and Karachi.

NIFT issued a statement claiming that there was no “significant compromise” of its data or systems. However, the statement suggests that some level of security breach did occur, although it was considered insignificant.

In response to The Express Tribune, NIFT stated on Friday that they are diligently working to restore the affected systems as quickly as possible without compromising on security.

“A comprehensive assessment and investigation is currently underway in collaboration with external security firms. Once the assessment is complete, we anticipate receiving recommendations to further enhance our security measures,” NIFT said.

SI Global CEO and IT expert, Noman Said attributed the security breach to NIFT’s negligence, its incapability to efficiently operate such a massive clearing system, and its poor security checks.

He underscored that NIFT, which is as important as the National Database Registration Authority (NADRA) and the Federal Board of Revenue (FBR), is being managed inadequately.

Currently, Pakistani banks hold deposits worth around Rs23 trillion with 67.5 million bank accounts. NIFT processes nearly 150,000 to 160,000 cheques through its online system every day.

Said expressed concern that the data of 67.5 million customers was put at high risk due to NIFT’s actions.

“This is not a small database and it was put at high risk by NIFT. Breach of such a large database is tantamount to compromising to national security,” said the SI Global CEO.

Although NIFT has a disaster recovery (DR) system in place to ensure service continuity in the event of a disaster like a cyberattack, Said expressed doubts regarding its proper functioning.

He remarked that if the NIFT DR system had been functioning correctly, the online clearing system could have been restored within minutes or hours. “It should have not taken days to recover the system. It is still trying to recover the system even seven days after the attack,” he lamented.

Commercial banks have complained about delays in the clearance of checks due to the restoration of the manual clearing system in the digital age.

Bankers have highlighted a lack of staff to manage the system manually and have demanded that the central bank assess whether NIFT is capable of handling such large-scale operations or if its functions need to be divided to improve efficiency and ensure national-level cybersecurity.

A spokesperson from the State Bank of Pakistan (SBP) stated that the bank is in contact with NIFT and has requested the institution to submit a plan outlining future safety measures to prevent a recurrence of such events.

In response to queries from The Express Tribune, NIFT revealed that preliminary evidence suggests a “well-organised attempt” was made to breach its systems. However, the attempt was swiftly detected, isolated, and halted.

“A detailed assessment in this regard is still ongoing. The effort is being spearheaded by a top-tier independent security assessment firm hired by NIFT and is being supervised closely by the SBP,” said the institution.

NIFT’s “preliminary assessment” indicates no data loss, but admits that “it is still too early to make definitive statements”. NIFT considers its customers’ data and privacy to be of utmost importance, and every effort is being made to ensure their information remains secure.

It is worth noting that day-to-day cheque clearing operations have resumed since Monday (June 19), and NIFT is assisting all banks under the supervision of the SBP to ensure successful processing of all cheques presented for clearing, said NIFT.

“This is a testament to our BCP and DR plans since we have been able to amend our cheque clearing process to provide continuous service to our customers.”

IT experts have highlighted the increasing occurrence of cyberattacks worldwide, especially with the growing reliance on online banking services.

In Pakistan, institutions such as the Federal Board of Revenue (FBR), NADRA, National Bank of Pakistan, K-Electric, and BankIslami have previously faced cyberattacks but were able to recover and resume normal operations.

The experts have emphasised the importance of adequately training monitoring staff to effectively prevent cyberattacks and respond to them when they occur. Additionally, sensitive institutions must continue investing in IT security systems, they said.