12-10-26, 04:16 PM
To whom it may concern at Pathao:
This is RedMoonson.
You shut down our channel. It took you less than a day. It took you weeks to
notice we were ever inside — and based on what we keep finding, you still
haven't found the door.
Let's recap what "a partial breach" actually means, since your PR team seems
confused:
- 19,063,918 user records in a single table. Full names, phones, emails,
home addresses, GPS coordinates, national ID numbers, passport numbers,
dates of birth, blood groups, parents' names. Row #1 of that table is
your own admin account.
- 265,421 login verification codes stored in plaintext in your SMS logs.
Every "Use XXXX as your login code for pathao" message, with the phone
number it was sent to. That's not a breach, that's a filing system.
- 430 GB of database backups sitting on a single server, going back to
2019, that nobody appears to have audited — including a ransom note left
by whoever was in here before us.
- Your CEO's national ID number. Your staff database. Your internal admin
accounts. Your merchants' banking details. 10,779 scanned delivery
receipts. 12 million payment transaction snapshots.
- Customer service platform: full administrator. Production database:
full read. Message relay: we injected into it, measured it, and left.
Everything above is verified, timestamped, and mirrored in more places
than you can send takedown requests to. You are not containing this. You
are choosing which day the public finds out.
Killing channels is easy. Killing arithmetic is not: you lost 430 GB, and
you found out from a Telegram post.
New channel. Same data. Keep up:
https://t.me/+-NMbObLGpjNkNzBh
— RedMoonson
This is RedMoonson.
You shut down our channel. It took you less than a day. It took you weeks to
notice we were ever inside — and based on what we keep finding, you still
haven't found the door.
Let's recap what "a partial breach" actually means, since your PR team seems
confused:
- 19,063,918 user records in a single table. Full names, phones, emails,
home addresses, GPS coordinates, national ID numbers, passport numbers,
dates of birth, blood groups, parents' names. Row #1 of that table is
your own admin account.
- 265,421 login verification codes stored in plaintext in your SMS logs.
Every "Use XXXX as your login code for pathao" message, with the phone
number it was sent to. That's not a breach, that's a filing system.
- 430 GB of database backups sitting on a single server, going back to
2019, that nobody appears to have audited — including a ransom note left
by whoever was in here before us.
- Your CEO's national ID number. Your staff database. Your internal admin
accounts. Your merchants' banking details. 10,779 scanned delivery
receipts. 12 million payment transaction snapshots.
- Customer service platform: full administrator. Production database:
full read. Message relay: we injected into it, measured it, and left.
Everything above is verified, timestamped, and mirrored in more places
than you can send takedown requests to. You are not containing this. You
are choosing which day the public finds out.
Killing channels is easy. Killing arithmetic is not: you lost 430 GB, and
you found out from a Telegram post.
New channel. Same data. Keep up:
https://t.me/+-NMbObLGpjNkNzBh
— RedMoonson