Bangladesh Citizens' Personal Data Traded Online in Expanding Security Breach
An extensive investigation reveals that citizens' personal data, including national IDs and mobile locations, is being openly bought and sold online. Security vulnerabilities in government websites and institutions have left millions exposed between 2024 and 2026.
Citizens' personal data is being actively bought and sold online in Bangladesh, according to recent findings covering the period from 2024 to 2026. Investigations by the research organization Dismilab have exposed a sprawling digital marketplace where sensitive information, ranging from national identity details to real-time locations and call records, can be easily purchased for modest sums of money.
During their investigation, Dismilab researchers successfully purchased national IDs, location data, and call records from three separate online vendors to verify the illicit trade. The pricing structure uncovered by the investigation reveals just how cheaply private information is traded: 'server copies' of national IDs cost between 50 and 200 takas, while obtaining a national ID using only a mobile number costs 250 takas. More intrusive services command higher prices, with three months of call logs priced at 900 takas and six months of call records available for 1,800 takas.
The illicit operations extend deep into surveillance and financial tracking, with live locations sold for 1,500 takas. Financial accounts are also heavily compromised, as data related to Nagad accounts costs 7,000 takas, and information concerning bKash transactions is priced at 7,500 takas. The scale of the digital black market expanded significantly, with data sales identified across 21 WhatsApp groups, 48 Telegram channels, and 720 Facebook groups and pages—totaling 789 platforms in the year 2024 alone.
This ongoing crisis builds upon prior systemic failures, notably in 2023, when security vulnerabilities on a government website dedicated to birth and death registration resulted in the exposure of approximately 50 million citizens' personal data. The wider security crisis has also impacted major corporate and state entities in Bangladesh, including Titas Gas, Popular Life Insurance, and City Bank, heightening concerns over institutional data protection.
The compounding digital security failures were further underscored in November, when an incident involving Titas Gas came to light, revealing that the organization's firewall 'root access' had been put up for sale on the dark web. Amid these alarming developments, experts such as Suman Ahmed Sabir and Tanvir Hassan Zohua have been monitoring the escalating digital threats as the country grapples with widespread leaks of personal information.
