[RedMLMON]

1. OVERVIEW
   

On or around September 8, 2026, our team gained unauthorized access to Pathao Corporation's entire production database infrastructure. Based on our findings, this may be the largest data breach in Bangladesh's history. Pathao has concealed the incident from the public for more than 27 days while publicly describing it as a "technical glitch."

1. SCALE OF THE BREACH
   

Total users affected: 19,063,918 (approximately 19 million). Database file size: 133 GB. Each user record contains 86 data fields.
Breakdown of compromised data:
Full names: 19,063,532 records Phone numbers: 19,063,914 records Email addresses: 19,063,918 records National ID (NID) numbers: 19,059,387 records Password hashes (bcrypt): 19,063,871 records Real-time GPS coordinates (latitude/longitude): 19,063,918 records Facebook access tokens: 19,063,918 records Profile photos: 18,994,621 records Home addresses: 5,739,178 records Driver's license numbers: 19,046,583 records Alternate phone numbers: 5,675,303 records

1. WHAT THIS MEANS FOR BANGLADESHIS
   

Every Pathao user's National ID number is compromised — not thousands, but 19 million. This enables identity theft, financial fraud, and synthetic identity crimes at unprecedented scale.
19 million Facebook access tokens were stolen. These tokens can potentially be used to access users' Facebook accounts, private messages, photos, and connected applications.
Real-time GPS coordinates for 19 million people were stored in the database — effectively a live tracking archive of where millions of Bangladeshis are right now.
19 million bcrypt password hashes are compromised. Many users reuse passwords across services. We have already cracked passwords using common password lists and will continue to do so.

1. PATHAO'S RESPONSE: SILENCE AND DECEPTION
   

Pathao VP Abrar Hasnain publicly called the incident a "technical glitch" — it was not. The corporate website (corp.pathao.com) was deleted from DNS because they could not restore it. The company blog (blog.pathao.com) was also deleted from DNS. Their food delivery service displayed "Access Denied" errors for days. Their main API was forced to return "418 Update Available" to all users — a forced-update mechanism deployed because their authentication systems were compromised. To date, Pathao has not notified a single user that their data was stolen. They have not reported the breach to the Bangladesh Cyber Security Council or to BTRC.

1. WHAT HAS ALREADY BEEN RELEASED
   

Over 4 million user records are publicly downloadable. An additional 1 million records are released every day. The full database is searchable through an encrypted Tor hidden service. Released data includes names, phone numbers, emails, NID numbers, and password hashes.

1. WHY WE ARE CONTACTING MEDIA
   

The Bangladeshi public deserves to know that their most sensitive personal data — including National ID numbers and real-time location — has been stolen. Pathao has had 27 days to notify users and has chosen silence instead. We are providing this information to media because: users have a right to know their data was compromised; Pathao should be held accountable for inadequate security; regulators (BTRC, ICT Division) need to investigate; and users need to change passwords and stay alert for fraud.

1. VERIFICATION MATERIALS AVAILABLE
   

Sample data records for verification (redacted for privacy) Screenshots of the database Technical details of how the breach occurred The onion site address where the data can be searched

1. ABOUT PATHAO
   

Pathao is Bangladesh's largest ride-sharing and delivery platform, serving millions of users across the country with motorcycle rides, car rides, food delivery, and parcel services. It is one of the country's most valuable tech startups.

1. CONTACT FOR VERIFICATION
   

Email: [email protected] Email: [email protected] Telegram: https://t.me/+_Q_5dlWEz184ZWJk
We are available for questions and can provide additional evidence upon request.
Sincerely, RED MONSOON

---

litter.catbox.moe/8dl2a8.json (500K+bcrypt)
→ litter.catbox.moe/4520sz.json (1M)
→ litter.catbox.moe/33yb2v.json (Neo4j 50K)
→ litter.catbox.moe/5272pt.json (Neo4j 450K)
→ litter.catbox.moe/j6twx3.json (100K NID)

---

One more thing must be made clear: the user database is only a fraction of what we hold. Our holdings extend far beyond what has been released — internal systems, corporate and financial records, and additional databases we have not yet named. The fact that we have not published them does not mean we cannot. It means we have chosen not to. Contact us within 72 hours, and you will never need to learn what that data contains. The countdown continues.

[RedMLMON]

https://x.com/newagebdcom/status/2106715...73513?s=46

[dragonish]

Any sample NID data?

[RedMLMON]

1. OVERVIEW
   

On or around September 8, 2026, our team gained unauthorized access to Pathao Corporation's entire production database infrastructure. Based on our findings, this may be the largest data breach in Bangladesh's history. Pathao has concealed the incident from the public for more than 27 days while publicly describing it as a "technical glitch."

1. SCALE OF THE BREACH
   

Total users affected: 19,063,918 (approximately 19 million). Database file size: 133 GB. Each user record contains 86 data fields.
Breakdown of compromised data:
Full names: 19,063,532 records Phone numbers: 19,063,914 records Email addresses: 19,063,918 records National ID (NID) numbers: 19,059,387 records Password hashes (bcrypt): 19,063,871 records Real-time GPS coordinates (latitude/longitude): 19,063,918 records Facebook access tokens: 19,063,918 records Profile photos: 18,994,621 records Home addresses: 5,739,178 records Driver's license numbers: 19,046,583 records Alternate phone numbers: 5,675,303 records

1. WHAT THIS MEANS FOR BANGLADESHIS
   

Every Pathao user's National ID number is compromised — not thousands, but 19 million. This enables identity theft, financial fraud, and synthetic identity crimes at unprecedented scale.
19 million Facebook access tokens were stolen. These tokens can potentially be used to access users' Facebook accounts, private messages, photos, and connected applications.
Real-time GPS coordinates for 19 million people were stored in the database — effectively a live tracking archive of where millions of Bangladeshis are right now.
19 million bcrypt password hashes are compromised. Many users reuse passwords across services. We have already cracked passwords using common password lists and will continue to do so.

1. PATHAO'S RESPONSE: SILENCE AND DECEPTION
   

Pathao VP Abrar Hasnain publicly called the incident a "technical glitch" — it was not. The corporate website (corp.pathao.com) was deleted from DNS because they could not restore it. The company blog (blog.pathao.com) was also deleted from DNS. Their food delivery service displayed "Access Denied" errors for days. Their main API was forced to return "418 Update Available" to all users — a forced-update mechanism deployed because their authentication systems were compromised. To date, Pathao has not notified a single user that their data was stolen. They have not reported the breach to the Bangladesh Cyber Security Council or to BTRC.

1. WHAT HAS ALREADY BEEN RELEASED
   

Over 4 million user records are publicly downloadable. An additional 1 million records are released every day. The full database is searchable through an encrypted Tor hidden service. Released data includes names, phone numbers, emails, NID numbers, and password hashes.

1. WHY WE ARE CONTACTING MEDIA
   

The Bangladeshi public deserves to know that their most sensitive personal data — including National ID numbers and real-time location — has been stolen. Pathao has had 27 days to notify users and has chosen silence instead. We are providing this information to media because: users have a right to know their data was compromised; Pathao should be held accountable for inadequate security; regulators (BTRC, ICT Division) need to investigate; and users need to change passwords and stay alert for fraud.

1. VERIFICATION MATERIALS AVAILABLE
   

Sample data records for verification (redacted for privacy) Screenshots of the database Technical details of how the breach occurred The onion site address where the data can be searched

1. ABOUT PATHAO
   

Pathao is Bangladesh's largest ride-sharing and delivery platform, serving millions of users across the country with motorcycle rides, car rides, food delivery, and parcel services. It is one of the country's most valuable tech startups.

1. CONTACT FOR VERIFICATION
   

Email: [email protected] Email: [email protected] Telegram: https://t.me/+_Q_5dlWEz184ZWJk
We are available for questions and can provide additional evidence upon request.
Sincerely, RED MONSOON

---

litter.catbox.moe/8dl2a8.json (500K+bcrypt)
  → litter.catbox.moe/4520sz.json (1M)
  → litter.catbox.moe/33yb2v.json (Neo4j 50K)
  → litter.catbox.moe/5272pt.json (Neo4j 450K)
  → litter.catbox.moe/j6twx3.json (100K NID)

---

One more thing must be made clear: the user database is only a fraction of what we hold. Our holdings extend far beyond what has been released — internal systems, corporate and financial records, and additional databases we have not yet named. The fact that we have not published them does not mean we cannot. It means we have chosen not to. Contact us within 72 hours, and you will never need to learn what that data contains. The countdown continues.

Any sample NID data?

https://litter.catbox.moe/2s9ol5.json

---

Dataset Volume Overview

Primary user master (users_full) — 19,063,918 accounts × 86 fields

Email / GPS / Facebook ID + access token: 19,063,918 (100%) Phone numbers: 19,063,914 Legal names: 19,063,532 Password hashes (bcrypt): 19,063,871 National ID (NID): 19,059,387 Driving licences: 19,046,583 Profile photos: 18,994,621 Home addresses: 5,739,178

Admin backend accounts (pathao_admin.backend_users) — 5,825 (login, email, password hash, reset codes)

HRIS employees (NID, salary, religion, emergency contacts) — 549

Admin access logs (source IPs) — 290,108

Merchants with bank account + routing — 17,943

Direct-debit records — 845,872

Wallet metadata / wallet tx logs — 7,550,717 / 4,039,743

Delivery tracking events — 39,515,497

Driver login query log — 32,728,015

E-com customers (ecom3 + ecom2) — 1,181,598 + 269,489

Corporate admins / employees / companies — 2,142 / 9,881 / 2,067

Total — ~250 million rows · 133 GB · 591 tables