In a climate of heightened vigilance against cyber threats, both governmental and private entities in Bangladesh have fallen victim to a surge in cyberattacks, resulting in data breaches. Notable casualties include the Investment Corporation of Bangladesh (ICB) and the Directorate General of Health Services (DGHS).
The extent of the ICB breach is substantial, encompassing sensitive information from approximately 10,000 investors and investment applicants. Among the compromised data are details of individuals investing in government mutual funds, including personal identifiers such as names, addresses, and bank account numbers.
Simultaneously, the DGHS suffered a data leak that exposed revenue collection statistics from government hospitals. Adding to the gravity of the situation, hackers asserted their possession of 40,000 records from the central bank, substantiating their claims with a screenshot of 40 records.
Furthermore, hacker groups disclosed the private data of select users on the land tax portal of the land ministry. While several other organizations endured less severe cyber incidents – ranging from website defacement to temporary shutdowns – prompt action led to their swift recovery, usually within hours.
To address these escalating threats, the Bangladesh Government’s Computer Incident Response Team (BGD e-GOV CIRT) had issued a warning earlier in the month. The alert emphasized that certain underground hacker groups with religious and ideological motivations were planning a coordinated cyber onslaught on August 15, targeting the country’s digital infrastructure.
In anticipation of these attacks, preemptive measures were adopted in collaboration with the Rapid Action Battalion, securing various government institutions and banks. Speaking at a press conference, Commander Khandaker Al Moin, director of Rab’s Legal and Media Wing, assured the public of counteractive steps taken against the looming cyber threats.
In an attempt to validate their prowess, the hacker collectives claimed access to Rab data, presenting a minor-scale leak as evidence. However, further investigation revealed the leaked data to be from a 2013 breach, casting doubt on their current capabilities.
This incident marks the second alleged data leak concerning the ICB this year, following a similar occurrence on June 20, as reported previously. The CIRT had issued a statement detailing the previous breach, citing that the hacker group had allegedly compromised the state-owned investment company, exfiltrating data from over 100,000 investors and applicants.
These incidents constitute a continuation of a series of attacks since March, some resulting in significantly larger data leaks involving the personal information of thousands of citizens.
Acknowledging the recent onslaught, CIRT project director Mohammad Saiful Alam Khan noted, “In the past 15 days, a variety of government entities have sought CIRT’s assistance to safeguard their systems. As a result of these preparations, we have managed to avert large-scale breaches. Our teams are working tirelessly to identify and mitigate ongoing attacks.”
