Mobilink (Jazz) Pakistan Mobile Operator Breach (2013): 44 Million Subscriber Records Including National ID Numbers Exposed

About Mobilink Pakistan

Mobilink, now operating as Jazz, is Pakistan's largest mobile network operator, providing voice, data, and mobile-financial services to tens of millions of subscribers. Owned by VEON, it maintains subscriber identity, CNIC (national ID), contact, address, and billing records required for SIM registration and regulated telecom onboarding in Pakistan.

Why They Hold Your Data

Telecom providers collect subscriber identity, phone numbers, service addresses, billing records, SIM and device data, and account-management information across mobile-service operations.

Recent Developments

The Mobilink brand was retired in favor of Jazz following the 2017 Mobilink-Warid merger, and Jazz remains Pakistan’s leading mobile operator. The leaked subscriber dataset resurfaced and circulated in criminal markets after appearing for sale in 2020; Pakistani authorities opened investigations into the source of the leak.

Data Points Exposed

Breach Impact

The exposure of full names, CNIC national identification numbers, home addresses, and phone numbers for roughly 44 million Pakistani subscribers, reportedly part of a larger ~115 million cache, creates severe identity-theft, SIM-fraud, and targeting risk across a large share of Pakistan's adult population. Because CNIC numbers anchor identity verification in Pakistan, their exposure is especially damaging and long-lasting.

Exploitation & Downstream Threats

• Identity theft and fraud using CNIC national ID numbers, names, and addresses | • SIM-swap and SIM-registration fraud using subscriber + CNIC data | • Targeted phishing, smishing, and vishing across a large share of Pakistan's population | • Doxxing and physical targeting from exposed home addresses | • Account-verification bypass using CNIC + name + phone

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).