- A hacker named 0xLei claims to sell stolen data from a government ministry in Bangladesh.
- The country has suffered multiple data breaches recently, including a security breach of a government website in March this year, due to technical weaknesses.
- Authorities admit security gaps exist, with the ICT state minister citing technical vulnerabilities and lack of log files, while a new Data Protection Act remains in development.
A cybercriminal, operating under the online name 0xLei, has put up for sale a data set allegedly stolen from a Bangladesh government ministry, the hacker targeted the Ministry of Expatriates’ Welfare and Overseas Employment. This ministry facilitates migration for Bangladeshi workers seeking employment in other countries and maintains records on millions of these workers’ identities.
According to the report, the threat actor claims to possess sensitive records from the ministry’s databases, but the exact size of the stolen data set remains unclear at this stage. Security experts are still investigating if the hacker’s claims are valid.
The timing of this reported breach may be a cause for concern as Bangladesh has put in numerous investments to digitize its global labour recruitment process. The government launched the Overseas Employment Platform, it gets support from the International Labour Organization to streamline migration processes.
Ministry Holds Vast Amounts of Sensitive Citizen Data
The Ministry of Expatriates’ Welfare and Overseas Employment oversees the entire labour migration process. The ministry’s digital systems contain personal information on millions of Bangladeshi citizens who work abroad, this includes names, passport numbers, national ID details, family information, and employment contracts.
This ministry’s Bureau of Manpower, Employment and Training is responsible for managing worker registrations, offering skills training programs, as well as providing placement services. Any instances of unauthorized access to these systems can result in compromising sensitive information revealed in sheer volume.
This is not the first security issue that has eroded the trust between citizens of Bangladesh and its data protection regulation system. In March this year, Zunaid Ahmed Palak, the Minister of State for Information and Communication Technologies directly admitted a security breach of a government website. He stated that a technical vulnerability caused the breach on the site which exposed citizen information.
Another major incident occurred in January 2026 when the Election Commission accidentally leaked personal data of approximately 14,000 journalists. The leak consisted of national identification numbers, mobile phone numbers and complete copies of their applications through a publicly accessible database. This leak occurred as a database administrator who mistakenly reopened the site when it was already shut down.
Bangladesh Authorities Struggle to Address Cyber Security Gaps
In Bangladesh, the government’s digital systems still suffer from security vulnerabilities. An investigation by the Digital Security Agency’s joint investigative team was unable to find the entire number of individuals whose personal information had been exposed through the birth/death registries; the lack of log files related to those systems impedes forensic investigation.
Internet experts have warned that exposing victims can significantly increase the risk to those who suffer compromised identity. As hackers may have access to their personal data, they can use this information to commit identity theft, open up new financial accounts, as well as make unauthorized purchases under the name of the victim.
In addition to the exposure of victims, there is also a substantial national security threat for individuals working in sensitive government positions, whose identities or personal information may have been exposed.
After acknowledging the severity of the problems, the government has announced its plan in developing a Data Protection Act, which is almost in its final stages. If passed, this new law would protect citizens’ data sovereignty by prohibiting additional unauthorized exposures of citizen data. However, critics claim legislation will not resolve the underlying technical issues or administrative lapses.
Government Promises Action as Data Breaches Multiply
The Digital Security Agency leads the government’s response to cyber threats – the agency has convened urgent meetings with operators of critical information infrastructure following recent incidents. Officials have also blocked problematic application programming interfaces that allowed public access to restricted data.
Home Minister Asaduzzaman Khan has promised stern action against those responsible for data leaks. However, no criminal investigation has yet begun into the latest reported breaches. Cyber security experts say Bangladesh needs stronger enforcement of existing rules and better technical training for government IT staff.
The International Labour Organization has provided technical support for Bangladesh’s Overseas Employment Platform. The ILO designed the system with single sign-on architecture and OTP-based authentication for security.
However, security experts note that even well-designed systems can fail – this happens especially if administrators do not follow proper procedures.
The same vulnerabilities exist in the private sector, the Everest ransomware group’s listing of Citizens Bank shows that financial institutions must constantly audit their security measures, as a single weakness can lead to customer data being posted on dark web extortion sites.
Officials have not yet confirmed whether the 0xLei listing contains authentic ministry records or fabricated information.
