Hackers demand $1.5m after breaching Shwapno’s customer database

Supermarket chain Shwapno has said that hackers breached its customer database and are demanding a ransom of US$1.5 million.
In a statement issued on Saturday, the company said reports had recently circulated across various media and social platforms regarding a potential data leak involving Shwapno customers.
“To maintain transparency, we would like to present the actual incident and the steps we have taken to our valued customers,” the statement said.
According to the company, members of an internationally notorious ransomware group demanded $1.5 million from Shwapno authorities on 20 August 2025.
However, the company refused to comply with what it described as “extremely unreasonable and illegal demands”.
“We would like to clearly state that any form of financial settlement with criminals goes against our institutional policies and ethical standards,” the statement added.
ACI Logistics Ltd, the operator of Shwapno, said it immediately informed the MIS Department of ACI Limited following the incident. Under the direct supervision of ACI’s director (MIS), a comprehensive audit was conducted.
After an in-depth assessment of the system, immediate preventive measures were implemented. The company emphasised that safeguarding customers’ personal information remains its highest priority.
According to the statement, ACI MIS has already taken steps to upgrade its IT infrastructure to world-class security standards. These include installing next-generation firewalls for internet and network protection, along with enterprise-grade security solutions to safeguard servers.
Advanced endpoint protection and antivirus systems have also been deployed across all servers, head office computers and outlets nationwide. In addition, dedicated local and international cybersecurity specialists have been appointed to monitor firewall logs and network traffic round the clock.
“Our outlet operations are conducted entirely through a secure offline and intranet system. As a result, during and after any cyberattack, our services across the country remain fully operational and secure,” the company said.
Legal action underway
The company said it has already taken legal steps to ensure maximum protection of customer data and bring those responsible to justice.
A case is currently being processed at Tejgaon Industrial Area Police Station. The Counter Terrorism and Transnational Crime (CTTC) unit of Dhaka Metropolitan Police, along with leading intelligence agencies, has also been formally informed. Authorities are pursuing strict legal measures with their cooperation.

The statement noted that many well-known organisations worldwide have fallen victim to major hacker groups such as LockBit and Qilin.
“However, we believe that maintaining transparency and standing by our customers during critical times is our true responsibility,” it added.
The company further assured that ACI Limited’s MIS team is working continuously to resolve the situation and that customers’ sensitive financial information remains secure.
Call for customer vigilance
Shwapno has urged customers not to share personal or financial information via calls or messages from unknown or suspicious sources, and to avoid clicking on suspicious links.
The company reiterated that it will never ask for passwords or OTPs over the phone and remains fully committed to protecting customer data.
Currently, Shwapno operates around 850 outlets across the country and has more than 40 lakh registered customers.