PFSA data breach exposes the identity risks in public-sector forensics

At a glance

What this is: This is a breach analysis of the Punjab Forensic Science Agency incident, where reported ransomware access led to exposure of large volumes of forensic and investigative records.

Why it matters: It matters because public-sector identity, access, and data governance must protect both operational systems and the records that can compromise investigations when exposed.

By the numbers:

• On November 7th 2025, Punjab Forensic Science Agency (PFSA) experienced a significant data breach, exposing over 900GB of sensitive forensic records.

👉 Read Gurucul's analysis of the PFSA data breach and exposed forensic records

Context

The primary issue here is not just ransomware, but uncontrolled access to highly sensitive forensic records that should have had tightly bounded identity and data controls. When investigation files, DNA data, and identity documents are reachable in bulk, the blast radius of any intrusion expands from systems disruption into evidentiary compromise and case integrity risk.

For identity and security teams, this is a governance problem spanning privileged access, segmentation, backup resilience, and data classification. Public-sector environments handling criminal justice data need stronger control over who can reach records, how long that access persists, and how quickly compromise can be contained once detected.

Key questions

Q: What breaks when ransomware reaches forensic records and identity data?

A: When ransomware reaches forensic records and identity data, the incident stops being a system outage and becomes a trust failure. Attackers can expose evidence, corrupt investigations, and create legal or operational disputes about what data remains usable. The key failure is excessive record reach, which turns one compromise into many downstream risks.

Q: Why do public-sector case systems need stronger access boundaries than ordinary business apps?

A: Public-sector case systems handle records with legal, evidentiary, and operational sensitivity that ordinary business apps usually do not. That means broad access can damage investigations, compromise privacy, and create chain-of-custody questions. Strong access boundaries reduce the chance that one compromised account can reveal unrelated sensitive material.

Q: What do security teams get wrong about ransomware recovery in evidence-heavy environments?

A: Teams often assume recovery is mostly about backup availability. In evidence-heavy environments, recovery also depends on whether the attacker can reach or tamper with backups, administrative paths, and supporting identity systems. If those paths remain exposed, restoration can be slow, untrustworthy, or impossible without reintroducing the compromise.

Q: Who is accountable when sensitive forensic records are exposed in a breach?

A: Accountability usually sits with both the data owner and the security governance function. The data owner must define sensitivity and access rules, while security must enforce segmentation, privilege limits, and recovery isolation. In regulated or public-sector environments, that accountability also extends to how evidence integrity and access review are documented.

Technical breakdown

How ransomware turns record access into investigation exposure

Ransomware becomes more damaging when the target environment contains high-value records rather than only operational systems. In this case, the attacker’s value comes from access to forensic files, identity records, and case material that can be stolen, published, or used for coercion. The technical issue is not simply encryption. It is the combination of data reachability, weak segmentation, and insufficient separation between user-facing systems and investigative repositories. Once an adversary can access those stores, the breach shifts from availability loss to confidentiality and evidentiary integrity loss.

Practical implication: isolate forensic repositories from general-purpose user and payroll systems.

Why privileged access and backup design shape breach impact

Ransomware impact depends on whether attackers can move from an initial foothold to critical records and then prevent recovery. If access is broad, service accounts are over-privileged, or backups sit online and reachable from the same domain, attackers can delete, encrypt, or exfiltrate data before defenders react. Air-gapped backups limit that outcome because they break the attacker’s ability to compound the incident. In records-heavy environments, privilege scope and recovery architecture are part of the breach surface, not just the recovery plan.

Practical implication: treat backup isolation and privileged access reduction as breach containment controls.

Why public-sector forensic data needs stronger data classification

Forensic labs handle multiple sensitivity tiers at once, from personal identity data to active case material. That makes blanket access models especially risky. Data classification is only useful if it drives enforcement, meaning roles, clearance levels, and network boundaries must align to the sensitivity of the record type. Without that linkage, a compromise in one system can expose unrelated but equally sensitive datasets. The result is a governance failure where one intrusion can affect evidence, personnel data, and court-facing material together.

Practical implication: map forensic record classes to distinct access tiers and review them separately.

Threat narrative

Attacker objective: The objective was to obtain and expose high-value sensitive records that could disrupt investigations, pressure the victim, or be monetised through ransomware leverage.

1. Entry appears to have led to access to Punjab Forensic Science Agency systems that stored or connected to forensic records, payroll material, and identity documents. Once inside, the attacker could reach multiple datasets rather than a single isolated application.
2. Escalation occurred through access broad enough to expose more than 900GB of sensitive records, showing that internal boundaries and privilege limits were insufficient to contain the compromise.
3. Impact followed through exposure of DNA data, crime scene evidence, and ongoing investigation details, creating risk to public safety, evidentiary integrity, and law enforcement operations.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Public-sector breach impact is determined by record reach, not just malware severity. When an attacker can touch forensic data, identity records, and case files in one environment, the incident becomes a governance failure as much as a security event. The decisive question is how much sensitive material the attacker could reach before containment. Practitioners should evaluate every high-value repository by its identity blast radius, not by system type alone.

Air-gapped recovery is a breach containment control, not a disaster-recovery luxury. The article’s recommendation to use air-gapped backups is directionally right because ransomware only becomes existential when defenders cannot recover without paying attacker demands or reconstituting from infected infrastructure. In public-sector and evidentiary environments, recovery design must assume the same adversary that reaches data may also reach backup paths. Practitioners should treat backup isolation as part of access governance.

Forensic data classification only works when access enforcement matches the sensitivity tier. The breach exposed DNA data, crime scene material, and identity documents together, which means the underlying control failure was not simply weak perimeter security. It was the absence of hard boundaries between classes of data with different legal and operational consequences. Practitioners should map evidence, payroll, and identity records to separate access and monitoring domains.

Standing access across shared systems creates a single point of failure for justice workflows. If payroll, identity documents, and investigation files share administrative pathways or over-broad roles, one compromise can disrupt multiple functions at once. That is exactly the kind of cross-domain exposure NHI governance is meant to prevent. Practitioners should review every shared-service account and privileged role that can traverse investigative and administrative datasets.

Beaconing on ransomware is not enough when the breach also threatens evidentiary trust. In environments like PFSA, the operational question is not only whether attackers were detected, but whether exposed data can still be trusted in court or investigation workflows. That raises the governance bar beyond conventional incident response. Practitioners should align security monitoring with evidence integrity and chain-of-custody requirements.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
• For a wider breach-pattern view, 52 NHI Breaches Analysis shows how access sprawl and stale credentials keep turning single weaknesses into repeat incidents.

What this signals

Record-heavy environments need identity controls that assume breach containment will fail unless access is already segmented. The PFSA case shows why forensic, payroll, and identity repositories should never share broad administrative reach. For teams managing sensitive public-sector data, the practical signal is to reassess where one compromised account can still traverse too many systems.

Identity blast radius is the right concept for evidence-centric security. If a single user or service account can expose evidence, personal identity data, and operational records together, the organisation has a governance problem rather than a tooling problem. That is exactly the sort of exposure pattern that makes access reviews and privilege reduction more than compliance exercises.

Ransomware response planning should be tied to data classification and recovery isolation, not only to endpoint containment. When high-sensitivity records are involved, the ability to restore cleanly and prove evidentiary integrity becomes part of the security outcome.

For practitioners

• Separate investigative and administrative data planes Place forensic case stores, payroll records, and identity documents in distinct network and access zones so a compromise in one system cannot expose the others. Review all cross-domain service accounts and administrative pathways for unnecessary reach.
• Make backup isolation verifiable Use air-gapped backups for critical records and test that restore paths do not depend on the same privileged credentials or domain trust as production systems. Recovery should remain available even if the primary environment is fully compromised.
• Tie clearance to record class Define access by evidence sensitivity, not just job title, and require separate approvals for forensic material, identity documents, and financial records. Re-certify those entitlements on a shorter cycle than standard administrative access.
• Monitor for bulk record access and unusual exfiltration paths Alert on large-scale reads, archive creation, and access from accounts that do not normally touch evidence repositories. Pair SIEM detections with EDR isolation so a ransomware foothold cannot expand into sensitive case stores.

Key takeaways

• The PFSA incident shows that ransomware becomes far more damaging when attackers can reach sensitive forensic records, not just encrypt systems.
• The scale of exposure, over 900GB of forensic and investigative material, indicates that access boundaries and recovery isolation were not sufficient to contain the blast radius.
• Public-sector organisations should separate record classes, tighten privileged access, and verify air-gapped recovery paths before the next incident tests those controls.

Key terms

• Identity Blast Radius: The amount of damage one identity can cause if it is compromised or misused. In practice, this is the set of systems, datasets, and actions reachable through a user, service account, or administrative role, and it is a better risk measure than account count alone.
• Evidence Integrity: The degree to which forensic material remains trustworthy, complete, and admissible after a security incident. Identity and access controls matter here because a breach can expose, alter, or contaminate records in ways that undermine legal and operational confidence.
• Air-Gapped Backup: A backup copy that is physically or logically isolated from the production environment and its credentials. For ransomware resilience, the key property is not just availability of copies but whether attackers who reach production can also reach the recovery path.
• Data Classification Enforcement: The practice of turning sensitivity labels into real access and monitoring controls. In high-sensitivity environments, classification only has value when it changes who can read, move, or restore records, and when those rules are reviewed against actual system reach.

What's in the full article

Gurucul's full blog covers the incident detail this post intentionally leaves for the source:

• The article's case-specific breach summary, including the stated date, target environment, and exposed record types.
• The supporting screenshots and document samples that show payroll, identity card, challan, and forensic analysis material.
• The vendor's incident-response recommendations for backups, segmentation, EDR, SIEM, and access control.
• The broader threat-intelligence framing around Beast ransomware and public-sector targeting.

👉 Gurucul's full post includes the sample documents, breach context, and prevention recommendations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.