Cyber Incident Victim: Karachi Port Trust
Date:
May 2025
Location:
Pakistan
Summary
The Karachi Port Trust reported that its social media account had been compromised shortly after it posted a message alleging heavy damage to the port from an Indian strike, later stating that the account was hacked and that port operations remained secure. Earlier the same account had claimed that the port sustained serious damage from an Indian attack and that emergency response efforts were underway. Shortly afterward, the trust issued a correction saying the attack reports were false and that shipping activity continued normally. Around the same time, the Pakistan government’s Economic Affairs Division said its own account was inaccessible after a post seeking international loans appeared, and officials described the incident as a hack. These events occurred amid heightened cross‑border tensions, including exchanges of missile and drone strikes between the two countries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On Thursday, Pakistan launched missile and drone strikes against Indian targets in Jammu, Rajasthan and Punjab. India's defence forces intercepted all incoming threats, preventing significant damage. This exchange followed Indian precision strikes on terror camps in Pakistan and Pakistan‑occupied Kashmir that were carried out in response to the Pahalgam attack. The heightened military activity contributed to a deteriorating security environment along the border.
On Friday morning, the Karachi Port Trust's official X account published a message stating that the port had sustained heavy damage following a strike by India, resulting in unacceptable loss of property, and that emergency response efforts were underway with regular updates on restoration to follow. Approximately two hours later, the same account posted that reports of a naval attack by India were completely false and baseless, and affirmed that ship traffic, shipping and cargo handling at the port were continuing as usual. Shortly after that, the account posted a declaration that its own account had been hacked, emphasizing that Karachi Port remained safe and secure.
The Karachi Port Trust's compromise was not isolated; the social media account of the Pakistan government's Economic Affairs Division also became inaccessible, displaying the message 'This account doesn't exist. Try searching for another.' Earlier on the same day, the Economic Affairs Division had claimed that its account was hacked after a viral post in which it appealed to international partners for additional loans, citing heavy losses inflicted by the enemy amid escalating war and a stock market crash. These successive account takeovers occurred amid the broader backdrop of worsening India‑Pakistan tensions.