6 million Bangladeshi CVs offered for sale on dark web

A hacker group identifying itself as "madarx" has advertised the sale of 60 lakh (6 million) Bangladeshi curricula vitae (CVs) on the dark web forum "darkforums.ru", claiming the data was taken from the database of leading job platform Bdjobs.

In a post on the forum, the group advertised what it described as "the CVs of 60 lakh jobseekers from Bdjobs".

The hackers claim the database contains detailed personal information, including names, phone numbers, physical addresses, email addresses, educational qualifications and professional experience, according to media reports

As proof, the group posted 148 sample CVs. An analysis of the samples showed that most appeared to be older records, with the information last updated between 2011 and 2017.

The group is offering the database for $1,000 and says it will sell access to a maximum of five buyers.

Bdjobs founder and CEO AKM Fahim Mashroor strongly denied the allegation that the data was stolen from the platform, saying the company has prioritised protecting users' information since it was established.

"Bdjobs had prioritised the security of users' information since its inception," Mashroor said.

He said recruiters registered with the platform can access jobseekers' information under specific conditions.

"Hundreds of thousands of registered recruiting organisations on Bdjobs can use their accounts to view jobseekers' information. However, they are allowed to use such information only for their own recruitment purposes," he said.

Mashroor also warned of legal consequences if organisations misuse or resell information obtained through the platform.

"If any organisation sells such information to a third party and the matter is brought to Bdjobs' attention, legal action will be taken against the organisation concerned..." he said.

Technology expert and International Crimes Tribunal prosecutor Tanvir Hassan Zoha said the alleged compilation of personal information could create significant risks even if individual pieces of data were not particularly sensitive on their own.

"If cybercriminals obtain a person's name, phone number, email address, home address, educational qualifications and professional information together, they can create a comprehensive digital profile of that individual," Zoha said.

He said criminals could use such profiles to target individuals with more convincing scams.

"Such information could be used for targeted phishing, fake job offers, identity fraud and financial scams..." he said.

The apparent age of many of the sample records could indicate that at least some of the information being offered is outdated. However, older personal data can still pose security risks if individuals continue to use the same phone numbers, email addresses or other identifying information.

Bdjobs has denied that its database was the source of the alleged leak.