A.   Background (BG)

1.   This refers to the related Important QCs in trail, blue, italic and double line (a) COQC648 of 29.5.25 about SECP Cyber Security Advisory & KCR (b) FRQC214 of 22.4.24 about Pak Suzuki Data Leakage and KCR (c) FRQC195 of 24.2.24 about Cyber Threats surge by 17% in 2023; Be careful

2.   We also refer to several Other matters including  (a) Official work at field formations: KTBA concerned at involvement of ex-FBR staff (b) KTBA slams access to taxpayers’ information (c) DNVC dated 24.8.21 KTBA urges FBR to secure data centre from hacking - TNS (d) DNVC dated 24.8.21 Unauthorized access to taxpayers data pointed out-PK

B.   Updated Commentary

1.    Further to KQU 3505 dated 8.8.25, being an important matter, we would inform you about Pakistan Petroleum IT system hit by cyber attack (Attachment 247.1) reported 24News TV Channel in the ensuing paragraph, with emphasis in bold & Underline for quick reading.

2.   Pakistan Petroleum Limited (PPL) faced a cyber-attack on its IT system as company's system related to the sale of oil and gas has been inactive for the past two days. 

3.   The hackers have demanded a ransom. Negotiations are going on between the company's IT experts and the hackers. The hackers had taken over the control of the company's IT system, and the management no longer has control over the PPL's financial affairs. 

4.   The Government and the relevant institutions have been informed about the situation. The company has also requested to activate the system from the relevant institutions. The other gas and oil companies have also been alerted and given a warning to take immediate precautions and actions. 

C.   Kasbati & Co Recommendation

KC reiterate our recommendation as earlier given vide FRQC 214 of 22.4.24 & COQC 648 of 29.5.25 that all the entities should be careful about their Data security, in order to avoid such extreme adverse eventuality, which may ruin the entity; or at least affect its Good name and Goodwill.

The IT team and Internal Auditor may also consider the same on an urgent basis

External Auditors data may also be affected in respect of the entity, etc, hence, they should also be careful. 

D.   Further Details & Services

Should you require any clarification or explanations in respect of the above or otherwise, please feel free to email Mr Amsal at amsal@kasbati.co with CC to info.kasbati@professional-excellence.com.