Hackers claim theft of 19 million Pathao accounts

A cybercriminal group has claimed to have exfiltrated personal data belonging to nearly 19 million Pathao users and is demanding $400,000 to withhold its disclosure, although the full scale of the alleged breach has yet to be independently verified.

The group asserts that it holds phone numbers, email addresses, national identity card numbers, driving licences, location data, Facebook profiles and residential addresses. The allegation was first reported on Wednesday by the cybersecurity platform Daily Dark Web in a post on X, accompanied by a screenshot of a purported dark-web listing. Furthermore, the hackers claim to have obtained 133 gigabytes of data, comprising roughly 250 million records across 591 databases, the largest of which allegedly contains 19,063,918 user accounts.

In a written statement, Pathao acknowledged that it had detected the theft of some personal information, including users’ names, email addresses and phone numbers. The company said it had taken immediate remedial measures and enlisted external cybersecurity specialists to fortify its systems. Moreover, following a temporary service disruption on October 4, several critical systems were taken offline as a precaution before services were restored. Nevertheless, Pathao cautioned that users might encounter intermittent technical difficulties while the stabilisation process continued.

Read More: TikTok launches AI shopping assistant

The group further alleges that it accessed employees’ personal details, administrative access records, merchants’ banking information, transaction data, delivery locations and drivers’ trip records, and it has reportedly threatened to release sensitive identity, banking and internal business information unless its ransom demand is met. Pathao said a comprehensive investigation was under way and that the relevant authorities would be notified in accordance with applicable procedures once the findings had been established. However, the purported volume of stolen data, the number of affected accounts and the ransom demand remain unverified, and the true magnitude of the breach is therefore still uncertain.