Pathao Confirms Cyberattack Exposed Some Users’ Names, Emails and Phone Numbers
Summary
Pathao confirmed malicious actors obtained some users’ names, email addresses and phone numbers in an October 4 incident that disrupted services. The number affected and access method remain unknown; the investigation is ongoing.
Key points
- Pathao said the incident occurred on October 4 and disrupted services; critical systems were taken offline as a precaution and services were later restored.
- The company confirmed that malicious actors obtained some users’ names, email addresses and phone numbers.
- Pathao has not disclosed the number of affected users, how attackers gained access, or whether other data was accessed.
- Claims of a 133GB leak containing more than 19 million user records, and claims involving sensitive data or a ransom demand, remain unverified by Pathao.
- Pathao said the incident affected operations in Bangladesh and Nepal and that its investigation is ongoing.
- The company engaged external cybersecurity experts, informed relevant authorities, and advised users not to share passwords, PINs or one-time passcodes in response to unsolicited messages or calls.
Article Details
- Victim Organization
- Pathao
- Incident Type
- Cybersecurity incident involving unauthorized acquisition of some users’ personal information and temporary service disruption.
- Data Types Exposed
- Names
- Email addresses
- Phone numbers
- Affected Records
- Unknown. Claims of more than 19 million user records and 250 million database rows were unverified by Pathao.
- Affected Data Size
- Unknown. An alleged 133GB data leak was unverified by Pathao.
- Operational Impact
- Pathao took critical systems offline as a precaution after the incident. Services were restored shortly afterwards, though some users could continue to experience intermittent problems while systems were stabilized. Operations in Bangladesh and Nepal were affected.
- Ransom Or Extortion
- Claims of a $400,000 USDT ransom demand were unverified; Pathao declined to comment on them.
- Claim Status
- confirmed
People
Countries
BangladeshPathao, one of Bangladesh’s largest ride-hailing and delivery platforms, said on October 7 that malicious actors had obtained some users’ personal information after a cybersecurity incident disrupted services earlierNepalFoyej added that the number of affected users could not yet be confirmed. He also confirmed that the incident had affected Pathao’s operations in both Bangladesh and Nepal.
Industries
DeliveryPathao, one of Bangladesh’s largest ride-hailing and delivery platforms, said on October 7 that malicious actors had obtained some users’ personal information after a cybersecurity incident disrupted services earlierRide-hailingPathao, one of Bangladesh’s largest ride-hailing and delivery platforms, said on October 7 that malicious actors had obtained some users’ personal information after a cybersecurity incident disrupted services earlier