12-10-26, 06:16 PM
# RedMoonson — Seven Days
To whom it may concern at Pathao,
You killed our channel. It took you less than a day. Meanwhile, your company has been bleeding customer data for years and it took you none.
We are giving you seven days to sort out the mess that is your company. Not a week of press statements. Not a week of "we are investigating." Seven days of actual cleaning: rotate the credentials, notify the customers whose national IDs you left lying in plaintext, and figure out how 19 million user records walked out of your infrastructure while your security team was busy not noticing.
Because here is what we are holding. All of it verified. All of it real.
19,063,918 user accounts — the full users table. Phone numbers, names, emails, bcrypt password hashes, dates of birth, national ID numbers, passport fields, home addresses, current and historical GPS coordinates of your customers, blood groups, parents' names. The first row of this table is your own admin account. That is not a leak metaphor. That is row one, column one.
265,421 plaintext OTP codes — SMS login codes for your customers, lifted from your own logs, sitting next to the phone numbers they unlock. Anyone with these can walk into accounts. Two hundred sixty-five thousand times over.
2,267,990 national ID records across three tables: delivery users with NID, license, date of birth and bike license; vehicle owners with 10-digit NID numbers and the file paths to their scanned NID photos; driver metadata with NID images and driving licenses. Plus 549 HRIS employee records — including 17 staff with full 17-digit smart-card national IDs. One of them belongs to your CEO.
32,496 Facebook access tokens issued by your own app. Dead now, but they prove you hoarded them.
120,000 bill-payment transactions from your mohajon service. 1.1 million SMS log entries with full message bodies. 10,779 scanned receipt PDFs — ride, parcel, food, rental — with signatures and addresses. 4.57 million customer records from Hermes. 5.8 million delivery records with sender and receiver names, phones, addresses and coordinates. 5,825 backend admin accounts with bcrypt hashes.
And the receipts of previous guests: someone was here before us. There is a ransom note table sitting in your deliveries database with two Bitcoin addresses and a contact email. You never even noticed that.
The pool is 430 GB. Everything above is the part we have already indexed. The rest is still opening.
Proof, as always: https://gofile.io/d/6XwLYKi7 — drop 8, 2.9 GB, no password. One million users_full rows with hashes and coordinates. A quarter million OTP codes. Two million NID records. Your staff. Your admins. Your receipts.
Seven days. The arithmetic does not negotiate.
If you want to talk before the next drop: https://t.me/+-NMbObLGpjNkNzBh
— RedMoonson
To whom it may concern at Pathao,
You killed our channel. It took you less than a day. Meanwhile, your company has been bleeding customer data for years and it took you none.
We are giving you seven days to sort out the mess that is your company. Not a week of press statements. Not a week of "we are investigating." Seven days of actual cleaning: rotate the credentials, notify the customers whose national IDs you left lying in plaintext, and figure out how 19 million user records walked out of your infrastructure while your security team was busy not noticing.
Because here is what we are holding. All of it verified. All of it real.
19,063,918 user accounts — the full users table. Phone numbers, names, emails, bcrypt password hashes, dates of birth, national ID numbers, passport fields, home addresses, current and historical GPS coordinates of your customers, blood groups, parents' names. The first row of this table is your own admin account. That is not a leak metaphor. That is row one, column one.
265,421 plaintext OTP codes — SMS login codes for your customers, lifted from your own logs, sitting next to the phone numbers they unlock. Anyone with these can walk into accounts. Two hundred sixty-five thousand times over.
2,267,990 national ID records across three tables: delivery users with NID, license, date of birth and bike license; vehicle owners with 10-digit NID numbers and the file paths to their scanned NID photos; driver metadata with NID images and driving licenses. Plus 549 HRIS employee records — including 17 staff with full 17-digit smart-card national IDs. One of them belongs to your CEO.
32,496 Facebook access tokens issued by your own app. Dead now, but they prove you hoarded them.
120,000 bill-payment transactions from your mohajon service. 1.1 million SMS log entries with full message bodies. 10,779 scanned receipt PDFs — ride, parcel, food, rental — with signatures and addresses. 4.57 million customer records from Hermes. 5.8 million delivery records with sender and receiver names, phones, addresses and coordinates. 5,825 backend admin accounts with bcrypt hashes.
And the receipts of previous guests: someone was here before us. There is a ransom note table sitting in your deliveries database with two Bitcoin addresses and a contact email. You never even noticed that.
The pool is 430 GB. Everything above is the part we have already indexed. The rest is still opening.
Proof, as always: https://gofile.io/d/6XwLYKi7 — drop 8, 2.9 GB, no password. One million users_full rows with hashes and coordinates. A quarter million OTP codes. Two million NID records. Your staff. Your admins. Your receipts.
Seven days. The arithmetic does not negotiate.
If you want to talk before the next drop: https://t.me/+-NMbObLGpjNkNzBh
— RedMoonson