09-10-26, 03:24 PM
Your public statement used the word "partial." We quite like that word, so we've decided to help you define it. 
The numbers, for your engineers to verify line by line:
Merged database: 133 GB, 591 tables, approximately 309 million rows.
Raw compressed SQL dumps: 717 files, 519 of which are pathao_* production databases.
The timespan covers your platform's entire operational history.
Breakdown by business line:
pathao_ecom3 — current e-commerce platform, 202 tables
oc_customer: roughly 1.18 million buyers — names, phone numbers, emails, full delivery addresses. Complete order history. Multi-vendor seller data. Full OpenCart schema.
pathao_ecom2 — previous-generation e-commerce, 101 tables
Approximately 270,000 customer records, complete with password hashes and salts.
pathao_api — main application API, 67 tables
user_social_profiles (505 MB of Google/Facebook linked accounts), drivers_meta, driver_login_query_log (371 MB), OAuth tokens, food delivery.
pathao_admin — internal administration, 59 tables
791,000 backend accounts.
The entire HRIS suite: employee files, payroll, bank account details, leave records, expense claims.
25 million backend activity log entries.
Your HR department is presumably unaware that their salary sheets and bank accounts currently live on someone else's hard drive.
pathao_rides_api — ride-sharing, 33 tables
Wallet transaction flows, driver commissions, promo campaigns, vehicle records.
pathao_business — corporate clients, 25 tables
Corporate rides, transactions, API tokens, payment_info.
pathao_shop_promo / ratings / topup — marketing, ratings, top-up balances.
Some samples (masked, as proof we actually opened these tables):
oc_customer:
112345 | R***a | Ah*** | rak***@gmail.com | +8801712*** | House 12, Road 5, Dhanmondi, Dhaka
HRIS employee:
PT-0*** | Md. S*** | Ops Executive | 28,000 BDT/month | bank acct 1501***7290 | NID 1990**********
driver:
D-88*** | K*** Miah | +8801826*** | NID 1978**** | motorcycle | wallet 4,320 BDT
Your customers and employees across Bangladesh and Nepal — their full names, phone numbers, emails, home addresses, National ID numbers, bank accounts, monthly salaries, password hashes — all of it sits on our drives.
When a company loses 300 million rows and calls it "partial," there are usually two explanations: either the security team still doesn't know how much was taken, or the PR department is writing their statements for them. Either way, "partial" is not your word to use.
The ball is in your court.
Contact: [email protected]
The numbers, for your engineers to verify line by line:
Merged database: 133 GB, 591 tables, approximately 309 million rows.
Raw compressed SQL dumps: 717 files, 519 of which are pathao_* production databases.
The timespan covers your platform's entire operational history.
Breakdown by business line:
pathao_ecom3 — current e-commerce platform, 202 tables
oc_customer: roughly 1.18 million buyers — names, phone numbers, emails, full delivery addresses. Complete order history. Multi-vendor seller data. Full OpenCart schema.
pathao_ecom2 — previous-generation e-commerce, 101 tables
Approximately 270,000 customer records, complete with password hashes and salts.
pathao_api — main application API, 67 tables
user_social_profiles (505 MB of Google/Facebook linked accounts), drivers_meta, driver_login_query_log (371 MB), OAuth tokens, food delivery.
pathao_admin — internal administration, 59 tables
791,000 backend accounts.
The entire HRIS suite: employee files, payroll, bank account details, leave records, expense claims.
25 million backend activity log entries.
Your HR department is presumably unaware that their salary sheets and bank accounts currently live on someone else's hard drive.
pathao_rides_api — ride-sharing, 33 tables
Wallet transaction flows, driver commissions, promo campaigns, vehicle records.
pathao_business — corporate clients, 25 tables
Corporate rides, transactions, API tokens, payment_info.
pathao_shop_promo / ratings / topup — marketing, ratings, top-up balances.
Some samples (masked, as proof we actually opened these tables):
oc_customer:
112345 | R***a | Ah*** | rak***@gmail.com | +8801712*** | House 12, Road 5, Dhanmondi, Dhaka
HRIS employee:
PT-0*** | Md. S*** | Ops Executive | 28,000 BDT/month | bank acct 1501***7290 | NID 1990**********
driver:
D-88*** | K*** Miah | +8801826*** | NID 1978**** | motorcycle | wallet 4,320 BDT
Your customers and employees across Bangladesh and Nepal — their full names, phone numbers, emails, home addresses, National ID numbers, bank accounts, monthly salaries, password hashes — all of it sits on our drives.
When a company loses 300 million rows and calls it "partial," there are usually two explanations: either the security team still doesn't know how much was taken, or the PR department is writing their statements for them. Either way, "partial" is not your word to use.
The ball is in your court.
Contact: [email protected]