13-10-26, 09:12 PM
On October 4, 2026, the core system of Pathao, one of Bangladesh's largest ride-hailing and delivery platforms, went down due to an attack. Three days later, on October 7, the company issued a statement on its social media accounts, acknowledging that a 'cybersecurity incident' had occurred and admitting that 'certain personal information, such as names, email addresses, and phone numbers, had been accessed by malicious actors.' By October 8, The Daily Star reached out to the company via email and got a response from Pathao's PR and Partnership Manager Md. Foyej: the claims circulating on dark web forums—133GB of data, about 19 million user accounts, 250 million database records, and $400,000 USDT ransom—'have not yet been verified by Pathao.' Clearly, Pathao's management (yes, I'm talking to you, Mr. Elius in New York!)
According to media such as Prothom Alo, the "attackers" claimed to have not only users' personal information but also employee files, backend management credentials, merchant bank accounts and bank codes, financial transaction data, delivery location information, and driver trip records (based on our mining of our servers, the data is much larger). The company spokesperson responded to these categories with the same sentence: NID, driver's license, location, address, and financial data "have not been verified at this stage." In other words, users were told "your name, email, and phone number have indeed been leaked," and also told "we will not comment on other more serious matters for now."
Then comes the most typical shift of responsibility: the company reminds users to "beware of strange information, calls, and links impersonating Pathao, and never provide passwords, PINs, or OTPs in reply." This advice itself is correct, but its position is critical. It translates a platform's security obligation into a user's personal vigilance obligation. Users have no choice but to give their phone numbers to or have the ability to audit Pathao's database (according to Pathao employees and our reports, these unfortunate capitalists still believe their own internal company employees leaked data, and now they are even facing double blackmail from Bangladesh's security authorities!)； The only thing they can do is not be deceived. Scammers rely on Pathao's leaked names, emails, and phone numbers to disguise phishing as believable—and the company's response is to make victims watch out carefully.
First, why did the accident occur on October 4th, but the public admission didn't happen until October 7th? During these three days, users continued to use the platform and hand over new data to a system that was already compromised, completely unaware.
Second, why was what was confirmed 'name, email, phone,' while what was refused to comment on was 'ID, address, location, financial data'? In terms of sensitivity, this confirmation order happens to start from the least important.
Third, why has the figure of nineteen million users neither been confirmed nor denied? An operator that can’t even clearly state the number of affected users can't make anyone believe it has the ability to control the scope of the damage.
Fourth, what did the company actually get? Public information shows Pathao has raised about $50 million in total funding, including $12 million in pre-Series B completed in September 2024, led by VentureSouq. If they have money for a funding launch, they should have money for data encryption, access control, intrusion detection, and incident response drills. Security investment isn’t a cost—it’s a prerequisite for whether this business can keep operating.
Fifth, where is the regulator? In 2018, the central bank could stop a wallet product for compliance issues. So in 2026, when a platform holding wallets and buy-now-pay-later services leaks user identity information, who is being held accountable? Has the company been investigated or asked to submit an audit report within a deadline? Has any user received one-on-one notification? So far, nothing is visible.
Pathao’s real problem isn’t being hacked this time—any platform could be hacked. The real problem is: from 2018 exposing collected SMS messages, to 2018 being stopped by the central bank from payment services, to 2019 breaking vehicle registration rules, to 2020 riders’ thirteen-point demands, to 2021 drivers stopping work all day, to 2025 disputes with banned drivers, to 2025 rate complaints and regulatory intervention in Kathmandu, and up to the 2026 October 19 million user data event—all these incidents follow the exact same pattern: first deny or delay, then emphasize 'under investigation,' then shift responsibility to users or third parties, and finally wait for public attention to die down.
We welcome all media to contact us. We will continue leaking data until negotiating with Pathao.
https://t.me/+-NMbObLGpjNkNzBh
https://gofile.io/d/6XwLYKi7
We are in possession of information regarding a security incident at Pathao. While the implementation of credential rotation is a standard security practice, we assess that it does not sufficiently mitigate the current threat. We urge you to treat this matter with the seriousness it requires and to cease any adversarial interactions with your users.
Please be advised that if a ransom is not paid, we will be compelled to sell or leak the compromised data, a course of action we wish to avoid. We strongly recommend that you address this incident and proceed with the ransom payment to prevent the necessity of incurring significantly higher costs in the future.
Please keep supporting us and subscribe to our new channel!
According to media such as Prothom Alo, the "attackers" claimed to have not only users' personal information but also employee files, backend management credentials, merchant bank accounts and bank codes, financial transaction data, delivery location information, and driver trip records (based on our mining of our servers, the data is much larger). The company spokesperson responded to these categories with the same sentence: NID, driver's license, location, address, and financial data "have not been verified at this stage." In other words, users were told "your name, email, and phone number have indeed been leaked," and also told "we will not comment on other more serious matters for now."
Then comes the most typical shift of responsibility: the company reminds users to "beware of strange information, calls, and links impersonating Pathao, and never provide passwords, PINs, or OTPs in reply." This advice itself is correct, but its position is critical. It translates a platform's security obligation into a user's personal vigilance obligation. Users have no choice but to give their phone numbers to or have the ability to audit Pathao's database (according to Pathao employees and our reports, these unfortunate capitalists still believe their own internal company employees leaked data, and now they are even facing double blackmail from Bangladesh's security authorities!)； The only thing they can do is not be deceived. Scammers rely on Pathao's leaked names, emails, and phone numbers to disguise phishing as believable—and the company's response is to make victims watch out carefully.
First, why did the accident occur on October 4th, but the public admission didn't happen until October 7th? During these three days, users continued to use the platform and hand over new data to a system that was already compromised, completely unaware.
Second, why was what was confirmed 'name, email, phone,' while what was refused to comment on was 'ID, address, location, financial data'? In terms of sensitivity, this confirmation order happens to start from the least important.
Third, why has the figure of nineteen million users neither been confirmed nor denied? An operator that can’t even clearly state the number of affected users can't make anyone believe it has the ability to control the scope of the damage.
Fourth, what did the company actually get? Public information shows Pathao has raised about $50 million in total funding, including $12 million in pre-Series B completed in September 2024, led by VentureSouq. If they have money for a funding launch, they should have money for data encryption, access control, intrusion detection, and incident response drills. Security investment isn’t a cost—it’s a prerequisite for whether this business can keep operating.
Fifth, where is the regulator? In 2018, the central bank could stop a wallet product for compliance issues. So in 2026, when a platform holding wallets and buy-now-pay-later services leaks user identity information, who is being held accountable? Has the company been investigated or asked to submit an audit report within a deadline? Has any user received one-on-one notification? So far, nothing is visible.
Pathao’s real problem isn’t being hacked this time—any platform could be hacked. The real problem is: from 2018 exposing collected SMS messages, to 2018 being stopped by the central bank from payment services, to 2019 breaking vehicle registration rules, to 2020 riders’ thirteen-point demands, to 2021 drivers stopping work all day, to 2025 disputes with banned drivers, to 2025 rate complaints and regulatory intervention in Kathmandu, and up to the 2026 October 19 million user data event—all these incidents follow the exact same pattern: first deny or delay, then emphasize 'under investigation,' then shift responsibility to users or third parties, and finally wait for public attention to die down.
We welcome all media to contact us. We will continue leaking data until negotiating with Pathao.
https://t.me/+-NMbObLGpjNkNzBh
https://gofile.io/d/6XwLYKi7
We are in possession of information regarding a security incident at Pathao. While the implementation of credential rotation is a standard security practice, we assess that it does not sufficiently mitigate the current threat. We urge you to treat this matter with the seriousness it requires and to cease any adversarial interactions with your users.
Please be advised that if a ransom is not paid, we will be compelled to sell or leak the compromised data, a course of action we wish to avoid. We strongly recommend that you address this incident and proceed with the ransom payment to prevent the necessity of incurring significantly higher costs in the future.
Please keep supporting us and subscribe to our new channel!