A public police portal became more than a complaint channel. It gave rival nation-state operators a trusted path into the same records stack, so one civic-facing system now exposes biometric and identity data to multiple espionage campaigns at once.
SentinelLabs says China- and India-aligned activity converged on Balochistan Police between February 2024 and April 2026. The affected systems included complaint management, biometric records, criminal case files, tenant registrations, personnel data, and other identity-linked records; clusters were tied to PlugX, ShadowPad, Cobalt Strike, Remcos, and TAG-179.
The risk is broader than one police force. Any public portal that reaches internal records can turn normal user interaction into a foothold on data that supports surveillance, targeting, and cross-domain intelligence collection.