Pierluigi Paganini
July 07, 2023
The researcher Viktor Markopoulos discovered a Bangladeshi government website that was leaking the personal information of millions of Bangladesh citizens.
According to TechCrunch, which first reported the news, the leaked data included full names, phone numbers, email addresses, and national ID numbers.
Markopoulos discovered the leak on June 27 and reported his discovery to the Bangladeshi e-Government Computer Incident Response Team (CERT).
The researcher explained that it was easy to find the leaked data only, he told TechCrunch that the data appeared in the results of a Google query related to an SQL error.
“TechCrunch was able to verify that the leaked data is legitimate by using a portion to query a public search tool on the affected government website. By doing this, the website returned other data contained in the leaked database, such as the name of the person who applied to register, as well as — in some cases — the name of their parents.” wrote Lorenzo Franceschi-Bicchierai from TechCrunch. “We attempted this with 10 different sets of data, which all returned correct data.”
TechCrunch attempted to contact several Bangladeshi government organizations without success.
At this time, the name of the government website was not publicly revealed because it is still leaking citizens’ data.
The compromise of the above information exposes impacted citizens to identity theft e scams.
Markopoulos added that a threat actor can use this type of information to access the web application on behalf of the citizens and “modify, and/or delete the applications as well as view the Birth Registration Record Verification.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Bangladesh)
