Millions of Bangladeshi citizens' personal information exposed in a government website

The personal information of over 50 million Bangladeshi citizens, including their full names, phone numbers, email addresses, and National Identification (NID) numbers, has been exposed through a data breach on a Bangladesh government website.

 

The leak was accidentally discovered by Viktor Markopoulos, a researcher at renowned cybersecurity organization Bitcrack Cyber Security, as reported by US-based online news outlet TechCrunch.

 

On June 27, Viktor Markopoulos stumbled upon the data leak and promptly informed the Bangladesh e-Government Computer Incident Response Team (CIRT) about the breach. Confirming the severity of the situation, Saiful Alam Khan Mohammad, the project director of BGD e-GOV CIRT, acknowledged the data leak.

 

TechCrunch conducted its own investigation to verify the legitimacy of the leaked data. Using a public search tool on the affected government website, they repeatedly searched for a portion of the leaked data and found that the website consistently confirmed the personal details of Bangladeshi citizens.

 

Viktor Markopoulos, who expressed surprise at how easily he found the data, revealed that it is still accessible online. "It just appeared as a Google result, and I was not even intending on finding it. I was Googling an SQL error, and it just popped up as the second result," he explained.

 

In response to the data breach, the BGD e-GOV CIRT Project issued a press statement terming the situation as a "situational alert on cyber threats." They emphasized their commitment to conducting a thorough investigation into the extent and impact of the breach, leaving no stone unturned in their pursuit of understanding the breach’s implications.

 

Despite TechCrunch’s attempts to seek further information from Bangladeshi authorities, including BGD e-Gov CERT, the government’s press office, the Bangladesh Embassy in Washington DC, and the Bangladeshi consulate in New York City, no response was received.

 

Addressing the incident at the Bangabandhu International Cyber Security Awareness Award program, Junaid Ahmed Palak, the State Minister of Information and Technology (ICT), assumed full responsibility for the data breach and stressed the urgency of addressing the issue promptly.