On Sunday (August 23) afternoon, a hacker group identifying as “madarx” posted an advertisement on a website named “DarkForums.ru” offering to sell the CVs of 6 million job seekers. The group claimed the data was extracted from the BDJobs database. They stated that the records include names, phone numbers, addresses, email IDs, educational qualifications, work experience, and training details.
The post set the price at $1,000 USD per copy, limited to a maximum of five buyers, and listed Paytm, Wise, PayU, and Binance as payment options. To support their claim, the group published 148 sample CVs. An analysis revealed that most of these samples are relatively old, with the majority last updated between 2011 and 2017. Reporters spoke with two individuals from the sample list—both private sector employees—who confirmed uploading their CVs to BDJobs several years ago.
Risks Identified by Experts
Cybersecurity experts view this potential data leak as alarming. Technology expert and prosecutor at the International Crimes Tribunal, Tanvir Hassan Zoha, noted that aggregating information like names, contact numbers, addresses, education, and career history allows bad actors to construct a detailed digital identity. This data can subsequently be exploited for cybercrimes such as phishing, fraudulent job offers, identity theft, and financial fraud.
BDJobs Denies Data Leak Allegations
BDJobs founder and CEO, Fahim Mashroor, dismissed the allegations of a data breach. He emphasized that BDJobs has always prioritized user data security, implementing necessary protection protocols along with access controls governing who can view candidate profiles.
Mashroor added that over a hundred thousand registered recruiting organizations have access to candidate details for hiring purposes. However, they are strictly required to use this information solely for recruitment. He stated that if any employer is found selling this data to third parties, BDJobs will take legal action upon notification.
(Source: Prothom Alo)
