- A vendor on the dark web allegedly offers a 4.15 GB production SQL database for $1,000, obtained from the e-commerce site Ghorer Bazar of Bangladesh.
- The database allegedly comprises a total of 4.27 million records, which include over 606,000 customer profiles, details of their e-wallet balances, addresses, order history, and internal accounting information.
- The dataset includes artificial intelligence chatbot conversation logs, exposing sensitive personal information disclosed by customers during online support interactions.
A cybercriminal operating on underground internet forums claims to hold a stolen production database. The listing targets Ghorer Bazar, a major e-commerce shopping platform operating in Bangladesh.
The seller asserts that he holds private consumer records plus technical data. However, at the present time, no independent cybersecurity experts have confirmed the validity or origin of the files in question.
Massive Database Dump Exposes Private Customer Identifiers
The dark web post advertises a single structured database file measuring 4.15 gigabytes in size. The seller states that this SQL dump holds 311 distinct database tables. Altogether, the dataset contains roughly 4.27 million individual data records collected from the shopping platform.
Specifically, the files expose around 606,000 registered user profiles. These profiles include customer full names, active mobile phone numbers, and private digital wallet balances. Additionally, the stolen material holds 372,000 physical delivery addresses alongside 449,000 order entries.
Furthermore, the database records indicate almost two million in shipped logs and package delivery information. Also, the seller claimed that they downloaded the production database on 23rd August, this year. Presently, the hacker placed a selling price of $1,000 in digital money for the access to the entire database.
Unprecedented Privacy Exposure from Leaked AI Support Chat Logs
Beyond basic contact lists, the database dump includes internal enterprise resource planning data. This accounting information shows business cash flows, vendor records, and inventory movements across regional warehouses. Consequently, leaking operational enterprise resource planning tables gives competing sellers deep insights into private retail strategies.
However, security analysts find the inclusion of customer support chat logs most alarming. The compromised dataset holds massive archives of conversations with automated artificial intelligence chatbots. When chatting with online virtual assistants during troubleshooting times, consumers often disclose sensitive information about themselves.
For example, clients may enter their order details, such as order numbers, banking codes, and contact numbers in chats, which can expose them to dangers. Therefore, exposed chatbot logs create deep privacy hazards for everyday platform users. Scammers can analyze these conversational records to build targeted phishing schemes against unsuspecting shoppers.
WhatsApp is testing an After Reading feature that automatically deletes messages 15 minutes after recipients open them, even when read receipts are disabled. The feature aims to quickly remove sensitive information, such as passwords and verification codes, from chats.
Operational Risks and Serious Fraud Dangers for Digital Shoppers
Revealing their residential address or telephone number exposes online customers to immediate danger. Fraudsters usually buy stolen lists of phone numbers to start aggressive spam marketing campaigns, they can send fake delivery alerts that reference real purchase histories to gain victim trust.
Moreover, exposing mobile wallet balances gives bad actors specific high-value target lists. Criminals can match high balance accounts with phone numbers to attempt unauthorized account takeovers. Additionally, threat groups can execute SIM swapping attacks to intercept SMS verification codes sent by financial providers.
Besides digital theft, small merchant vendors listed in the logistics records face supply chain fraud risks. Extorted vendor lists allow competitors to undercut prices or disrupt local distribution networks. Consequently, a single database exposure damages customer trust and operational stability across the regional retail sector.
Essential Security Measures and Mandatory Corporate Incident Response
To start with, affected retail shoppers should update their account login credentials right away. Users must change passwords across any secondary websites that share identical login details. Additionally, customers should activate multi-factor authentication on their connected mobile wallet applications to prevent any unauthorized login attempts.
Furthermore, customers should be careful when getting messages on their phones or calls from unknown sources. Reputable online stores never ask their customers for passwords of their accounts and digital wallet pins over phone. Moreover, they should not click any unverified links regarding package tracking arriving through unknown messaging platforms.
Instead, shoppers should confirm package shipping statuses directly through official retail portals. Enterprise network security teams must conduct thorough digital forensic audits across all database servers. Administrators should check database access logs, restrict remote administrative permissions, and apply strong encryption protocols across stored records.
Finally, corporate platforms must limit how long virtual assistants store personal chat interactions. Deleting idle chatbot logs reduces long-term data leakage risks during unexpected server security breaches. As forensic investigations continue, consumers must rely on official security notices from local data protection authorities.
