Play store
Personal information allegedly belonging to nearly 19 million users of Bangladesh-based digital services platform Pathao has been compromised, with hackers demanding $400,000 to prevent its release.
The alleged data breach reportedly involves phone numbers, email addresses, national identity card (NID) numbers, driving licence details, photographs, location data, Facebook profiles and home addresses. However, the claims have not been independently verified.
Cybersecurity monitoring platform Daily Dark Web highlighted the alleged breach in a post on social media platform X, formerly Twitter, last Wednesday. It also shared a screenshot of a post on the dark web detailing the alleged stolen data.
In a written statement, Pathao acknowledged that unauthorised individuals had accessed some users’ personal information, including names, email addresses and phone numbers.
The company said it took immediate steps to contain the incident and brought in external cybersecurity experts to strengthen its systems and ensure data security. It added that the relevant authorities would be updated in accordance with applicable regulations as the investigation progresses.
Pathao said its services were temporarily disrupted on October 4 after it detected a cybersecurity incident. As a precaution, the company took some critical systems offline to protect its platform and user data. Services were restored shortly afterwards, although users may continue to experience minor technical issues while the systems are stabilised.
In a statement posted on its verified Facebook page, Pathao also urged users to remain alert to suspicious messages, phone calls or links claiming to be from the company. It advised users never to share their passwords, PINs or one-time passwords (OTPs) in response to such communications, adding that verified updates would be published through its official channels.
According to the dark web post, the group behind the alleged breach claims to possess around 133 gigabytes of Pathao data, comprising approximately 250 million records across 591 databases.
The largest database allegedly contains information on 19,063,918 accounts. The group also claims to hold more than 19 million NID numbers and phone numbers, driving licence details and user photographs, as well as around 5.7 million home addresses.
The alleged stolen material reportedly includes internal and business information, such as employee records, administrative access documents, merchants’ bank account details and bank branch identification codes, transaction records, delivery location data and drivers’ trip logs.
The group has reportedly demanded $400,000 from Pathao and threatened to release NID, banking, employee and administrative information if the payment is not made.
The scale and authenticity of the alleged data theft remain unverified.