Bangladesh government website leaks citizens’ personal data: TechCrunch

A Bangladesh government website has leaked the personal data of ‘millions’ of citizens, according to US website TechCrunch.

The leak was discovered by a cybersecurity researcher through a regular Google search, says bdnews24.com citing a report published by TechCrunch.

Viktor Markopoulos, a researcher for Bitcrack Cyber Security, told TechCrunch he accidentally discovered the leak on June 27 and informed the e-Government Computer Incident Response Team (CERT) of Bangladesh.

“We are looking into it,” said CERT Project Director Saiful Alam Khan when asked about the incident on Saturday. “We may make a statement to the media later this afternoon.”

The full names, telephone numbers, email addresses, and national ID numbers of Bangladeshi citizens were included in the leak, the TechCrunch report from Thursday said.

Markopoulos told the outlet that finding the data ‘was too easy’.

“It just appeared as a Google result and I wasn’t even intending on finding it. I was Googling an SQL error and it just popped up as the second result,” he told TechCrunch, referring to SQL, a language designed for managing data in a database.”

He warned that the data could “be used in the web application to access, modify, and/or delete the applications as well as view the Birth Registration Record Verification".

TechCrunch says they used 10 different sets of data on the public search tool of the government website and were able to verify the data. The website returned other data contained in the leaked database such as the name of the person who applied to register and, in some cases, the name of their parents.

The publication declined to name the government website as the data is still available online.