Shawdesh desk:

Officials have acknowledged a significant data breach where the personal information of Bangladesh’s smart National Identity Card (NID) holders is now readily available in a channel on Telegram, an instant messaging service.

The country’s NID server holds information of approximately 120 million voters, of which approximately 55 million possess smart NID cards.

Users have reported that a Telegram bot can provide individuals’ names, gender, parents’ names, phone numbers, addresses, photos, and other personal details when a 10-digit NID number is entered.

Mohammad Ashraf Hussain, the system manager at the NID wing of the Election Commission, told the media that he became aware of the issue on Tuesday but remained uncertain about the identity of the culprits behind the Telegram channel.

It has been determined that the data leak occurred through one of the 174 organizations that have access to the NID server.

Ashraf Hussain said appropriate action is being taken in this regard, without disclosing the name of the organization involved.

He said: “Organizations obtain information from the Election Commission for their portals. Sometimes, their portals may have vulnerabilities that lead to security compromises.”

On the other hand, AKM Humayun Kabir, the director general of the NID wing, claimed he was not aware of the situation and asserted that the NID server remains secure.

This incident follows a prior data breach on June 7, as reported by TechCrunch, which exposed the personal information of around 50 million Bangladeshi nationals through a government website.

At the time, State Minister for ICT Division Zunaid Ahmed Palak attributed the leak to a server breach in the Office of the Registrar General.

The leaked data encompassed names, phone numbers, email addresses, and NID numbers of individuals.

In response to the earlier breach, ICT experts recommended continuous surveillance of organizations that access services from the NID server.

They also suggested the Election Commission conduct regular vulnerability assessments and penetration tests on the server to detect and address potential weaknesses.