A group of hackers has claimed to possess sensitive information belonging to approximately 19 million Pathao user accounts and demanded $400,000 in ransom, threatening to release the data if the company fails to pay, according to cybersecurity monitoring platform Daily Dark Web.
Daily Dark Web disclosed the alleged breach on Wednesday through a post on X (formerly Twitter) sharing a screenshot of a dark web listing in which the attackers claimed to have obtained 133 gigabytes of information from the Bangladeshi digital services company.
The group claims the stolen information includes National Identity (NID) numbers, mobile phone numbers, driving licence details, photographs, residential addresses, location data and financial records.
Although the authenticity and extent of the alleged data theft could not be independently verified, Pathao has acknowledged that malicious actors accessed some personal information, including users' names, email addresses and phone numbers.
According to Daily Dark Web, the attackers claim to possess approximately 250 million records across 591 databases, with the largest database containing information relating to 19,063,918 accounts.
The alleged dataset includes more than 19 million NID and mobile phone numbers, driving licence details and photographs, along with home addresses of approximately 5.7 million individuals.
The group also claims to have obtained Pathao's internal business records, including employee information, administrative access details, merchant bank account information, financial transactions, delivery locations and drivers' trip histories.
The attackers have reportedly threatened to release sensitive identity, banking, employee and administrative information unless Pathao pays the $400,000 ransom.
However, the claims about the volume and categories of stolen data remain unverified, and it is unclear whether the records represent unique individuals or multiple entries associated with the same accounts.
Pathao has not confirmed the hackers' claim that information relating to approximately 19 million accounts was compromised.
It has also not established whether NID numbers, driving licence records, financial information or location histories were accessed.
Services disrupted after October 4 attack
Pathao said it detected a cybersecurity incident on October 4 and temporarily shut down critical systems to protect its platform and users' information.
The precautionary shutdown disrupted several services.
In a statement published on its verified Facebook page on Wednesday, the company said services had been restored shortly afterward, although users could experience minor technical difficulties while system stabilisation continued.
Pathao said external cybersecurity specialists had been engaged to strengthen security and investigate the incident.
While Pathao has confirmed unauthorised access to some user information, the central claims publicised by Daily Dark Web -- including the alleged 19 million accounts and $400,000 ransom demand -- have yet to be independently verified.
