A researcher says a Bangladesh government site is leaking data of millions of citizens, including names, phone numbers, email addresses, and national ID numbers
Lorenzo Franceschi-Bicchierai / TechCrunch : Twitter: @lorenzofb and @lorenzofb Twitter: Lorenzo Franceschi-Bicchierai / @lorenzofb : We verified the data thanks to a sample shared by @vict0ni, who found the leak. We used some of the data to query the government website that was leaking, and it returned other data, also contained in the sample. No answer from @bgdegovcirt. https://techcrunch.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : NEW: A Bangladeshi government website leaked the personal data of “millions” of citizens, according to the security researcher who found the data. Data includes: full names, phone numbers, email addresses, and national ID numbers. https://techcrunch.com/...
Context & Ripple Effects
Security researcher vict0ni found a Bangladeshi government website returning citizens' names, phone numbers, email addresses, and national ID numbers, with TechCrunch verifying the leak by querying the live site against a shared data sample. Days later, Bangladesh's Computer Incident Response Team pulled the exposed data offline, claiming a "prompt" response — though the disclosure itself went unanswered at first.
The episode repeats a familiar failure mode in state-run databases: India's state gas company once left sensitive customer records including Aadhaar numbers exposed via search-engine indexing, while comparable national-ID troves have surfaced in Turkey and China. What distinguishes this case is that the leak sat on a government website serving queries, not just a misconfigured storage bucket.
First-order effects
- Millions of Bangladeshi citizens now have their national ID numbers, phone numbers, and email addresses circulating outside government control — the exact combination needed for targeted phishing and identity fraud.
- Bangladesh's CIRT was forced into reactive containment, taking down the exposed dataset after a researcher's disclosure rather than detecting the exposure internally.
Second-order effects
- The verified-query method TechCrunch used — submitting sample records to the live site and matching returned data — gives other researchers a repeatable playbook for confirming state-site leaks, raising disclosure pressure on agencies that don't run bug-bounty channels.
- With national ID numbers exposed alongside contact details, Bangladeshi banks, telcos, and any service relying on NID verification inherit a fraud problem they didn't create, since the ID number is meant to be the trust anchor.
Third-order effects
- If the pattern holds — national-ID databases leaking through basic web misconfiguration in Turkey, India, China, and now Bangladesh — the structural lesson is that centralized biometric-and-ID registries concentrate catastrophic risk in single points of failure that most governments lack the operational discipline to defend.
- Repeated researcher-found leaks of state data also push toward external audit requirements for government web infrastructure, since internal incident response has consistently arrived only after public disclosure.
The trend: Government-operated national ID databases keep leaking through elementary web-security failures, turning state identity systems themselves into the largest source of citizen-data breaches.