Hackers claim to have stolen data of nearly 19m Pathao users, demand $400,000
Pathao has not confirmed the alleged scale of the breach or identified those responsible, but has acknowledged that some users' personal information has fallen into the hands of 'malicious actors'.
A cybercriminal group has claimed to have stolen 133GB of sensitive data belonging to 19 million customers from the servers of Pathao, a Bangladeshi technology company offering ride-sharing, delivery and financial services.
Pathao, in a statement on Wednesday (7 October), did not confirm the alleged scale of the breach or identify those responsible. However, the company acknowledged that some users' personal information had fallen into the hands of "malicious actors".
The hackers claim the stolen data includes mobile phone numbers, email addresses, national identity card (NID) numbers, driving licence details, location data, Facebook profiles and home addresses.
🇧🇩 BANGLADESH: PATHAO ALLEGEDLY HIT WITH 133GB DATA EXTORTION, 19M USER RECORDS CLAIMED A threat actor on an underground forum has posted a public "notice" to Pathao Limited, the Dhaka-based ride-hailing, delivery and fintech super app, claiming to hold its production data and demanding payment. The listing claims: * ~250 million rows across 591 tables (133 GB) * A user master table of 19,063,918 accounts with emails, phone numbers, legal names, password hashes, GPS data and Facebook IDs/access tokens * 19,059,387 National ID (NID) numbers and 19,046,583 driving licence entries, plus profile photos and 5.7M home addresses * HR records for 549 employees (NID, salary, religion, emergency contacts), 17,943 merchant bank account/routing records and 845,872 direct-debit records * A 400,000 USDT ransom demand with a 24-hour deadline, and a threat to keep releasing data The claim has not been independently verified. ⚠️ Analyst Note: The post lists table names and row counts, but the captured page shows no sample records, so the figures cannot be checked. A Pathao claim from what appears to be the same actor first surfaced a day earlier, and the actor says a local newspaper has already reported a service outage; Pathao has not confirmed either. If genuine, national ID, licence and address data at this scale would create serious identity-fraud and SIM-swap risk in Bangladesh. This is an unverified threat-actor claim, NOT confirmation that Pathao was breached. Users should expect Pathao-themed phishing and account-recovery scams and should change any reused passwords. #DDW #DarkWeb #Bangladesh #Pathao #DataBreach #Extortion #ThreatIntelligence #CyberSecurity
— Dark Web Intelligence (@DailyDarkWeb) October 7, 2026
Keep updated, follow The Business Standard's Google news channel
They have reportedly demanded cryptocurrency worth $400,000 from Pathao in exchange for the data.
The cybersecurity platform Dark Web Intelligence reported the alleged breach on X on Wednesday. It also shared a screenshot of the post published on the dark web.
The claims, however, could not be independently verified.
What data does the group claim to possess?
According to the dark web post, the alleged database contains around 250 million rows of data stored across 591 tables.
The person behind the post claims to have obtained a primary user database containing records of 19,063,918 accounts.
The database allegedly includes email addresses, phone numbers, names, hashed passwords, GPS data, Facebook IDs and access tokens.
The post also claims to contain 19,059,387 NID card numbers and 19,046,583 driving licence records. It further alleges that the database includes around 5.7 million home addresses.
Beyond customer information, the hackers claim to have obtained internal records of 549 Pathao employees, including NID details, salaries, religious affiliations and emergency contact numbers.
The alleged haul also includes 17,943 merchant bank account and routing records, as well as information on 845,872 direct-debit financial transactions.
The group has demanded 400,000 USDT, a cryptocurrency known as Tether, pegged to the US dollar, as ransom for the data.
It reportedly gave Pathao just 24 hours to pay, threatening to release the confidential information online in stages if the payment was not made.
The claimed volume and nature of the stolen data have yet to be independently verified.
Pathao acknowledges data breach
In its statement, Pathao outlined its response to the incident but did not confirm the alleged theft of 133GB of data, the reported records of nearly 19 million accounts or the $400,000 ransom demand.
The company said its platform experienced service disruptions on 4 October.
After detecting a cybersecurity incident, it temporarily took some critical systems offline as a precaution to protect the platform's security. Services were restored shortly afterwards, according to Pathao.
"We understand that certain personal information, including names, email addresses and phone numbers, was obtained by malicious actors," Pathao said, adding, "Relevant authorities have been informed, and Pathao is cooperating closely with them as the investigation and response continue."
Pathao urged customers to remain vigilant in light of the breach. It advised users to be cautious of unsolicited messages, phone calls and links from anyone claiming to represent the company.
Users were also warned never to share their passwords, PINs or one-time passwords (OTPs) with anyone.
The company apologised to users, drivers, merchants and partners for the disruption to its services.
