Growing Crisis of Data Security

Bangladesh’s digital transformation is often celebrated through the convenience it brings to everyday life. A ride can be booked with a few taps, groceries can be delivered to the doorstep, and household purchases can be completed without visiting a shop. Businesses have expanded their reach, consumers have saved time, and digital platforms have become an increasingly important part of the economy. Yet a troubling question lies beneath this progress: what happens when the systems designed to make life easier become potential sources of insecurity?
Recent reports on ride-sharing and grocery applications, as well as e-commerce platforms, suggest that the protection of customer information deserves far greater attention in Bangladesh. They expose a fundamental weakness in the country's digital development: the collection of personal information has become central to commercial activity, but the responsibility to protect that information has not received comparable public scrutiny.
According to reports published in October, cybercriminals obtained 133 gigabytes of data associated with approximately 19 million customer accounts of the ride-sharing application. They reportedly demanded $400,000 in cryptocurrency and threatened to leak information. On the other hand, in September 2026, a cyber intelligence platform reported that more than 4.2 million records allegedly associated with the Bangladeshi e-commerce platform had been offered for sale on a dark web forum. The seller claimed to possess a 4.15-gigabyte production database obtained from the company in August and offered access to it for $1,000. In August 2025, a major retail chain’s website was hacked, and the leaked information was being circulated online. The cybercriminals demanded $1.5 million since August 2025 to restore access, but the company refused to comply.  
The compromised data for these companies includes names, email addresses, phone numbers, passwords, GPS logs, purchase history, NIDs, home addresses, employee records and merchant bank account information. Three of these companies advised users never to share passwords or PINS and to be cautious of suspicious communications. 
These three cases should not be presented as identical events or as proof of a single systemic failure. Yet together, they raise serious questions about the security of personal information collected by Bangladesh's digital and retail businesses. The danger extends well beyond the disclosure of names and telephone numbers. A phone number linked to a real identity, home address, purchasing history or location record can become a powerful instrument for deception. Criminals may use authentic details to impersonate service providers, manipulate victims into revealing authentication codes or construct fraudulent messages that appear to come from legitimate businesses. Exposed passwords and access tokens may also create opportunities to compromise other accounts, especially when users reuse credentials across services.
A delivery address alone reveals little about a person's life. A purchase history may reveal preferences or spending habits. A location record can indicate movement patterns. However, when these details are combined, they can provide a remarkably intimate picture of an individual. The commercial database thus becomes something more consequential than a collection of records: it becomes a map of people's lives.
This creates an imbalance between the companies that collect information and the customers who provide it. Consumers may choose a platform because it offers competitive prices, convenience or reliable delivery, but they cannot independently inspect its cybersecurity systems. They are asked to protect their own passwords and avoid suspicious links, yet they have little control over how their personal information is stored, who can access it or how long it is retained. Even a cautious customer may be exposed to risks arising from weaknesses in a company's infrastructure.
It is therefore inadequate to respond to every breach by advising the public to be more careful. Individual vigilance is necessary, but it cannot replace corporate responsibility. Businesses that collect sensitive information must invest in regular independent security assessments, encryption, restricted access, continuous monitoring and tested incident-response procedures. They should collect only the information necessary to provide their services and establish clear rules for deleting records that are no longer needed. Sensitive customer support conversations and identity documents require particularly careful treatment.
Transparency is equally important. Customers need prompt and accurate information when their data may have been exposed. Companies should explain what information got affected. Trust cannot be preserved through general assurances that security measures are being strengthened. It requires evidence of responsible action.
The government also has a responsibility to ensure that cybersecurity is not left entirely to companies. Bangladesh needs effective and enforceable standards governing the collection, storage, processing and protection of personal data. Regulatory authorities must have the technical capacity to investigate incidents, assess organisational practices and determine whether companies have met their obligations. Clear requirements for breach notification and meaningful avenues for compensation would encourage businesses to take prevention seriously. Where negligence causes demonstrable harm, customers should not be left without a credible means of seeking redress.
___________________________
The writer is an academic, 
journalist and political analyst. 
He can be reached at 
[email protected]