6 million Bangladeshi CVs advertised for sale on dark web

Hacker group identifying itself as ‘Madrax’ has advertised the sale of curriculum vitae (CVs) of 6 million Bangladeshi citizens on the dark web. They claimed the CVs were taken from the database of Bangladesh’s job platform Bdjobs. However, Bdjobs has denied the allegation of this data leak.

The hacker group published the advertisement on a website named ‘darkforums.ru’ around noon on Sunday. In the post they claimed to have CVs of 6 million job seekers of Bdjobs and said these CVs contain name, phone number, address, e-mail, educational qualification, career experience and training information. The hacker group further informed that the price of one copy of these CVs is 1,000 US dollars and the information will be sold to a maximum of five buyers.

In support of the claim the group also published samples of 148 CVs. Analysis of these CVs showed most of them are old. Among them the number of CVs last updated between 2011 and 2017 is higher.

Cyber security experts have expressed concern over this incident of leaking citizens’ personal information. Prosecutor of the International Crimes Tribunal and technology expert Tanvir Hasan Juha told the media, “If name, phone number, e-mail, address, educational qualification and career information contained in a CV are obtained together, cyber criminals can create a complete digital profile of a person.” He also said targeted phishing, fake job offers, identity fraud and financial scams can be carried out using this information.

However, Fahim Mashroor, founder and chief executive of Bdjobs, has denied the allegation of leaking citizens’ information. He told the media, “Bdjobs has been giving the highest importance to the security of users’ information from the beginning and along with taking necessary security measures for data protection there are also various controls on who can see users’ profiles and who cannot.”

Fahim Mashroor further said, “More than a hundred thousand registered employer organisations on Bdjobs can view job seekers’ information using their accounts, but permission exists to use this information only in their own recruitment process.” He said legal measures will be taken against any employer organisation if it sells this information to a third party and the matter is informed to Bdjobs.