View source for 2023 Bangladesh Government website data breach

{{Short description|none}}
In June and July 2023, a major data breach occurred in a Bangladesh Government website, resulting in the unauthorized exposure and compromise of personal data belonging to more than 50 million Bangladeshi citizens.<ref>{{Cite web |date=2023-07-08 |title=Over 5 crore Bangladeshi citizens' personal data 'exposed' online |url=https://www.tbsnews.net/bangladesh/millions-bangladeshi-citizens-data-exposed-online-661958 |access-date=2023-07-12 |website=The Business Standard |language=en}}</ref><ref>{{Cite web |date=2023-07-08 |title=Sound the alarm bell: Inside the leak of 50 million Bangladeshis' personal data |url=https://www.tbsnews.net/bangladesh/inside-leak-50-million-bangladeshis-personal-data-662174 |access-date=2023-07-12 |website=The Business Standard |language=en}}</ref><ref>{{Cite web |title=Bangladesh government website leaks citizens' personal data: TechCrunch |url=https://thefinancialexpress.com.bd/national/bangladesh-government-website-leaks-citizens-personal-data-techcrunch |access-date=2023-07-12 |website=The Financial Express |language=en}}</ref>

== Background ==
On July 7, 2023, it was discovered that a government website in Bangladesh had inadvertently exposed the personal data of citizens due to security vulnerabilities.<ref>{{Cite web |last=Franceschi-Bicchierai |first=Lorenzo |date=2023-07-07 |title=Bangladesh government website leaks citizens' personal data |url=https://techcrunch.com/2023/07/07/bangladesh-government-website-leaks-citizens-personal-data/ |access-date=2023-07-12 |website=TechCrunch |language=en-US}}</ref> The breach was not a result of a deliberate hack, but rather a consequence of weaknesses in the infrastructure and data protection practices of the websites. The exposed data included sensitive information such as names, addresses, phone numbers, and national identification numbers.<ref name=":1" /><ref>{{Cite web |last=Paganini |first=Pierluigi |date=2023-07-07 |title=Bangladesh government website leaked data of millions of citizens |url=https://securityaffairs.com/148264/data-breach/bangladesh-government-website-data-leak.html |access-date=2023-07-12 |website=Security Affairs |language=en-US}}</ref> From October 2023, the leaked NID data of Bangladeshi citizens are openly accessible on Telegram channels.<ref>[https://bangla.dhakatribune.com/bangladesh/71632/%E0%A6%8F%E0%A6%A8%E0%A6%86%E0%A6%87%E0%A6%A1%E0%A6%BF%E0%A6%B0-%E0%A6%AB%E0%A6%BE%E0%A6%81%E0%A6%B8-%E0%A6%B9%E0%A6%93%E0%A7%9F%E0%A6%BE-%E0%A6%A4%E0%A6%A5%E0%A7%8D%E0%A6%AF-%E0%A6%AE%E0%A6%BF%E0%A6%B2%E0%A6%9B%E0%A7%87-%E0%A6%9F%E0%A7%87%E0%A6%B2%E0%A6%BF%E0%A6%97%E0%A7%8D%E0%A6%B0%E0%A6%BE%E0%A6%AE-%E0%A6%9A%E0%A7%8D%E0%A6%AF%E0%A6%BE%E0%A6%A8%E0%A7%87%E0%A6%B2%E0%A7%87?fbclid=IwAR1JUChDqBZooyDq0Dhgh8NWTPJ_gh9ryREAsJIcRVfoS__Z_Oalb1IUyw0 এনআইডির ফাঁস হওয়া তথ্য মিলছে টেলিগ্রাম চ্যানেলে] (dhakatribune.com)</ref>

== Breach incident ==
The breach was initially reported by American technology news website TechCrunch, on July 7, 2023. According to their reports, the exposed data was accessible via the government website, potentially allowing unauthorized individuals to access and misuse citizens' personal information. They initially did not reveal the website's name as breached data were still accessible, however they later revealed that the data breach occurred in the Office of the Registrar General, Birth & Death Registration website.<ref name=":1">{{Cite web |last=Franceschi-Bicchierai |first=Lorenzo |date=2023-07-10 |title=Bangladesh government takes down exposed citizens' data |url=https://techcrunch.com/2023/07/10/bangladesh-government-takes-down-exposed-citizens-data/ |access-date=2023-07-12 |website=TechCrunch |language=en-US}}</ref> The incident raised concerns about privacy and data security, causing alarm among affected individuals.<ref name=":0">{{Cite web |date=2023-07-09 |title=সরকারি ওয়েবসাইট থেকে ব্যক্তিগত তথ্য ফাঁসে কী ধরণের ঝুঁকিতে পড়বেন আপনি? |url=https://www.bbc.com/bengali/articles/c51vdzx0l74o |access-date=2023-07-12 |website=BBC News বাংলা |language=bn}}</ref>

Zunaid Ahmed Palak, the state minister for Information and Communication Technology in Bangladesh, acknowledged the breach and clarified that it was not the result of hacking but rather a consequence of the security weaknesses presents in the websites. Palak further explained that the websites had vulnerabilities that were exploited, resulting in the exposure of citizens' personal data.<ref>{{Cite web |date=2023-07-09 |title=Site's weakness to blame for exposing citizens' data: Palak |url=https://www.tbsnews.net/bangladesh/not-hacked-sites-weakness-responsible-exposing-citizens-data-palak-662418 |access-date=2023-07-12 |website=The Business Standard |language=en}}</ref><ref>{{Cite web |last=Tech & Startup Desk |date=2023-07-09 |title=Personal data leak by govt. website: No scope to evade responsibility, says Palak |url=https://www.thedailystar.net/tech-startup/news/personal-data-leak-govt-website-no-scope-evade-responsibility-says-palak-3364701 |access-date=2023-07-12 |website=The Daily Star |language=en}}</ref>

== Government Response ==
In response to the data breach, the Bangladesh government took action to address the situation. On July 10, 2023, the government announced the takedown of the exposed citizens' data, ensuring that it was no longer accessible to unauthorized individuals. The affected government websites were temporarily shut down to address the security vulnerabilities and strengthen their data protection measures.<ref>{{Cite web |last=Ferdous |first=Raiyan |title=Press Release July 08 2023: Alert from CIRT |url=https://www.cirt.gov.bd/press-release-july-2023-alert/ |access-date=2023-07-12 |website=BGD e-GOV CIRT {{!}} Bangladesh e-Government Computer Incident Response Team |language=en-US}}</ref><ref name=":1" />

Additionally, the government launched an investigation into the incident to ascertain the extent of the data exposure and identify the parties responsible for the security weaknesses. The objective was to prevent similar incidents from occurring in the future by implementing more robust security protocols and measures to safeguard citizens' personal information.<ref name=":1" />

== Impact and Controversy ==
According to experts, the data breach had significant implications for the affected citizens and raised concerns about data security in the country. The exposure of personal data could potentially lead to fraudulent activities, identity theft, or other malicious purposes. The breach underscored the need for stringent cybersecurity practices and triggered discussions about the security measures implemented by government websites in Bangladesh.<ref>{{Cite web |last=ডেস্ক |first=হাল ফ্যাশন |title=ব্যক্তিগত তথ্য ফাঁস হলে যেসব ঝুঁকিতে পড়তে পারেন আপনি |url=https://www.haal.fashion/lifestyle/cdmq4ynr2b |access-date=2023-07-12 |website=Haalfashion |language=bn}}</ref><ref>{{Cite web |date=2023-07-10 |title=সাইবার সিকিউরিটি: বাংলাদেশে সরকারি দপ্তরের তথ্য ফাঁস কতটা বিপজ্জনক হয়ে উঠছে? |url=https://www.bbc.com/bengali/articles/crgl23e9lm2o |access-date=2023-07-12 |website=BBC News বাংলা |language=bn}}</ref>

The incident generated controversy and prompted discussions regarding the government's responsibility in protecting citizens' data. Critics argued that the data breach highlighted a lack of attention to cybersecurity and a failure to prioritize the protection of sensitive information.<ref name=":0" /> Others emphasized the importance of regular security audits and timely detection and remediation of vulnerabilities.<ref>{{Cite web |last=হোসেন |first=বি এম মইনুল |date=2023-07-11 |title=বোঝা গেল ডিজিটাল নিরাপত্তাব্যবস্থা কতটা খারাপ |url=https://www.prothomalo.com/opinion/column/816zladhqo |access-date=2023-07-12 |website=Prothomalo |language=bn}}</ref>

== See also ==
* [[List of data breaches]]
* Office of the Registrar General, Birth & Death Registration

== References ==
{{reflist}}

[[Category:Data breaches]]
[[Category:Internet privacy]]

{{Sourceattribution|2023 Bangladesh Government website data breach}}