Metro Pakistan, one of the country's largest wholesale retail chains, has allegedly suffered a significant data breach, with a threat actor known as xklahadore advertising more than one million records for sale on a well known cybercrime forum. The dataset reportedly includes approximately 425,000 records containing personally identifiable information and over 611,000 transaction and order entries spanning multiple major Pakistani cities.
What Happened
According to listings observed on an underground cybercrime forum, a threat actor operating under the handle xklahadore has claimed unauthorized access to Metro Pakistan's internal systems. The actor is offering the stolen dataset for sale, with samples shared publicly to validate the authenticity of the claim. The samples reportedly include not only standard customer records but also sensitive administrative level information, including data tied to Super Admin accounts, suggesting the intrusion may have reached deeper into Metro Pakistan's infrastructure than a typical customer database exposure.
At this stage, Metro Pakistan has not issued a formal public statement confirming the incident, and the claims remain based on actor assertions and leaked samples circulating in cybercrime channels.
What Was Taken
The alleged leak contains two primary data classes. The first is a set of roughly 425,000 individual user records. The second is a collection of more than 611,000 transaction or order related entries. Reported fields include:
- National identification numbers, full names, gender, and dates of birth
- Email addresses, phone numbers, and login IDs
- Complete residential addresses with street level detail
- Geographic markers covering Karachi, Faisalabad, Lahore, Islamabad, and Multan
- Account types, store identifiers, active status flags, and account creation timestamps
- Wallet balances and voucher indicators tied to signup and birthday promotions
- Privacy policy agreement status and employee numbers
- Super Admin account records included in sample data
Why It Matters
The combination of granular personally identifiable information, financial indicators like wallet balances, and precise residential addresses creates a high risk profile for affected individuals. Attackers can leverage such data for targeted phishing, SIM swap attacks, physical fraud, and identity theft across Pakistan's digital banking and telecom ecosystems.
The alleged inclusion of Super Admin credentials is the more strategic concern. If authentic, it indicates either compromised privileged accounts or insufficient segmentation between administrative and customer facing systems. For defenders, this signals a pattern increasingly observed in regional retail breaches: threat actors pivoting from exposed application endpoints into back office systems and monetizing full database dumps rather than narrow credential sets.
The Attack Technique
The initial access vector has not been publicly disclosed. However, the presence of administrative account data in the exposed sample suggests one of several plausible paths: exploitation of an unpatched internet facing application, abuse of weak or reused administrative credentials, a compromised third party integration with access to Metro Pakistan's customer database, or SQL injection and related web application flaws allowing bulk exfiltration. The advertisement on a cybercrime forum, along with public sample sharing, aligns with the initial access broker and data broker ecosystem that has repeatedly targeted South Asian retail and e commerce platforms throughout 2025 and into 2026.
What Organizations Should Do
- Rotate all administrative and Super Admin credentials immediately and enforce phishing resistant multi factor authentication on privileged accounts.
- Audit access logs for anomalous administrative activity, bulk database queries, and unusual outbound data transfers over the past 90 to 180 days.
- Review segmentation between customer facing applications and back office administrative interfaces, eliminating direct exposure of admin panels to the public internet.
- Monitor underground forums and paste sites for additional samples tied to the xklahadore handle and related identifiers.
- Notify potentially impacted customers and regulators in line with Pakistan's Personal Data Protection framework, and prepare fraud mitigation guidance for affected individuals.
- Conduct a targeted web application assessment and credential hygiene review across all customer facing and partner integrated systems.