-
A threat actor claims it stole 133GB of Pathao production data covering about 250 million rows in 591 tables.
-
The alleged haul includes user, National ID, driving license, address, employee and merchant records.
-
No independent evidence confirms the breach, and Pathao has not publicly confirmed the claims.
A threat actor has posted an extortion notice aimed at Pathao, claiming access to a huge amount of data from the Bangladesh-based ride-hailing and delivery company.
The post demands $400,000 in USDT and gives Pathao 24 hours to pay. It also threatens to release more data if the company does not meet the demand.
However, the claim is currently unverified. The threat actor listed table names and record counts, but didn’t share any samples to back their claims.
What the Attacker Claims to have
Pathao is not only confined to booking rides on their platform. The application offers rides, food deliveries, parcel deliveries and payments through its platform. As such, the allegation is quite a serious one because it concerns the sensitive data offered by this platform.
The mobile app listings also indicate that the application handles personal and location information. While this allegation can be taken to be valid in general, the numbers in the database, as well as access to all of the listed systems, cannot be proved to be true.
The claimed dataset contains more than 250 million rows, covering 591 tables. The size of the entire database is estimated to be approximately 133GB by the attacker.
The largest claimed database in the post is a User Master database with 19,063,918 users. According to the post, the database includes emails, phone numbers, legal names, password hashes, GPS data and Facebook ID/access token.
Other claimed databases in the post include 19,059,387 National IDs and 19,046,583 Driving License numbers, 5.7 million home addresses and profile images.
If this database turns out to contain legit and fresh data, it’d give criminals enough info to carry out all sorts of fraudulent activity. Victims would be at risk of targeted scams, fake account recovery, or even identity theft.
The leak also exposes HR records for 549 employees. People’s national ID numbers, salary info, religion, and emergency contacts are all in there, according to the forum post. On top of that, it’s got 17,943 merchant bank accounts and routing details. There’s another set of 845,872 direct-debit records, all reportedly part of the breach.
No Samples were Visible
The underground forum post provides detailed information on the table name and the number of rows. However, the captured page fails to present sufficient visible data that could verify whether such tables exist and whether the numbers provided are true.
A monitoring feed reporting the claim identified it as an unverified threat actor allegation. Later, another security news site published a report on the claim. None of these sources offers independent evidence that the systems of Pathao experienced any hack attack.
This same actor had reported a claim about Pathao on the previous day and stated that a local newspaper carried the news. This study found no verifiable report linking Pathao’s outage to any cyberattack.
Such distinction is important because even though a database claim may have real-looking numbers in it, this does not mean that the hacker has access to the company’s system.
Similar unverified claims involving major organizations have also surfaced, including hacker claims of a major data breach of the Chinese Military, seeking buyers online. The database can have old or fake information.
Pathao Has Confirmed the Breach
Pathao’s official press pages indicate their announcements up until October 08, 2026, which include updates on their delivery services, food services, and payment services. A public notice now confirms this alleged breach.
Pathao continues providing all the services related to the movement of people, food and payments. They have a help center for their users, where their application or account issues can be solved.
Why the Alleged Data Would Matter
The claimed National ID, license, and address records would create serious risks if authentic. National ID is particularly sensitive in nature since it helps criminals to build profiles on their victims. It can be used together with phone number and address in order to carry out impersonations and social engineering.
The alleged GPS data would be another aspect to look at since it gives away the locations of where one lives, works or regularly travels.
The phone numbers could also play a part in account takeovers. Criminals could make use of any leaked personal information to convince support agents, recovery services and even the victims in giving away any one-time codes.
The alleged password hashes also need attention even though they are not the actual passwords themselves. Reused and weak passwords still pose risks because hackers can easily crack them. The alleged Facebook access tokens would be yet another risk if they’re active and valid.
While waiting for more updates regarding the claim, there are several precautionary steps that one could take. Users should change their passwords if they have reused Pathao passwords elsewhere. Each account should have a password of its own.
Pay attention to any message with big promises of helping you recover your account. Also, if they promise to give you a refund, or check whether your security is strong, run!
Hackers love to use a new breach to make people panic. And in that situation, they will fall for their phishing scams because everything sounds like the truth.
Very importantly, don’t give anyone your passwords, or any one-time code you receive. In fact if someone sends you a link to recover your account all of a sudden, suspect them.
