Hackers target CDA billing system, demand ransom in Bitcoin

ISLAMABAD: City managers have spent three tense days as unknown hackers reportedly breached the Capital Development Authority’s (CDA) property and water billing system and demanded ransom in bitcoins, Dawn has learnt.

CDA’s data related to property and conservancy charges has been compromised, and the hackers are allegedly threatening to upload the data on the dark web if the ransom is not paid, sources have revealed.

“Since it is June (closing month), and a large number of people clear their property and tax dues this month, our systems have been hacked for the last three days,” said an official of the CDA revenue directorate.

He said the revenue directorate, CDA’s vendor NRTC, and the Information Technology Department were making all-out efforts to restore the data. “Hopefully, the matter will be resolved by Friday (today),” he said.

Meanwhile, several citizens told Dawn that they were unable to pay their taxes as CDA’s online links remained down. The CDA website was functional, however, the “Pay your bills online” link was inaccessible until the filing of this report at 9pm on Thursday.

The civic agency maintains data of all residential and commercial properties in city areas, including allotted residential and commercial plots, while properties in rural areas are handled by the revenue department of the district government.

Earlier, in 2024, Indian hackers reportedly breached the CDA website and uploaded data on the dark web. The website was restored after a few days, and the incident raised alarm not only within the civic body but also at the federal government level.

Following that incident, the Prime Minister’s Office also took notice. The CDA board later authorised the civic agency to engage a cyber security firm under a running contract to safeguard its digital infrastructure and services.

An official of the IT wing said that after the 2024 incident, a cyber security firm had been engaged by the CDA. Meanwhile, another official claimed that CDA and its vendor had no backup data for the last six months; however, the claim was rejected by CDA spokesperson Shahid Kiani.

Mr Kiani said that CDA’s billing system related to property and conservancy charges and water was under cyberattack, but added that all backup data was safe.

“CDA is currently recovering all billing-related data from its secure backup servers to ensure nothing is lost. Technical teams are working, and the online system will be made functional again very soon,” he said.

All online payments made so far are completely safe as they were processed through the 1-Link system or other authorised online banking channels,” he added.

Published in Dawn, June 19th, 2026