6 million Bangladeshi CVs allegedly put up for sale on dark web

A hacker group has claimed that it is offering the CVs of around 6 million Bangladeshi citizens for sale on the dark web, alleging that the data was obtained from the country’s leading online job platform, Bdjobs.

The group, which identifies itself as MadRax, reportedly posted the offer on the website Dark Forums on Sunday, seeking $1,000 from each of five potential buyers. The group claimed that the database contains names, phone numbers, addresses, training records, academic information and professional experience.

MadRax also published 148 CVs as samples to support its claim. According to the supplied report, an analysis of those documents found similarities in their format with Bdjobs’ CV template. The samples reportedly included CVs belonging to both men and women and contained extensive personal information.

The report said at least three people whose information appeared in the sample documents were contacted. They confirmed that they had CVs on Bdjobs, but said they were not aware that their information had appeared elsewhere. They also said they had not received any notification from Bdjobs about the alleged exposure.

Bdjobs founder and chief executive Fahim Mashrur denied that the company was aware of a breach of its database. He said that if such an intrusion had occurred, the company would have known about it.

Mashrur also said employers can pay to access job seekers’ CVs through Bdjobs, while some users publish their CVs on other professional platforms such as LinkedIn. He suggested that information could potentially reach other parties through such channels.

He further said that other parties could be using the Bdjobs name in connection with the alleged data sale.

Cybersecurity analyst and ethical hacker Abdullah Al Jaber disputed the suggestion that the situation could be explained simply through legitimate access to CVs or scraping from other platforms. He questioned whether such methods could realistically produce a database containing information on 6 million users.

Al Jaber also warned about the risks associated with the circulation of personal information contained in CVs, including names, addresses, phone numbers, email addresses, education records and employment histories.

According to him, such information could potentially be misused for identity fraud, financial scams, spam or phishing. He urged people to exercise caution when dealing with unsolicited calls, emails, messages and links from unfamiliar sources.

The hacker group’s claim has not been independently established as proof that the data came from Bdjobs. While the group has published sample CVs and claimed they originated from the platform, Bdjobs has denied knowledge of a database breach. The actual source of the alleged 6 million CVs therefore remains unresolved based on the information available in the supplied report.