Bangladesh government citizen data leak

In July 2023, a misconfigured website operated by Bangladesh's Office of the Registrar General, Birth & Death Registration was found to be leaking the personal data of more than 50 million citizens — one of the largest exposures of government-held PII in South Asian history. The data was not stolen by a sophisticated intruder; it was simply sitting in plain view, indexable by Google.

What happened

On 27 June 2023, Viktor Markopoulos, a researcher at South Africa-based Bitcrack Cyber Security, was troubleshooting an SQL error and pasted it into Google. The exposed Bangladeshi database "just appeared" as the second search result. As Markopoulos put it, finding the data "was too easy."

The leaking endpoint belonged to a Bangladeshi government website that drew on the national identity (NID) ecosystem. The exposed fields included citizens' full names, addresses, phone numbers, email addresses and national ID numbers — the exact combination needed for identity theft and financial fraud.

TechCrunch, which verified and disclosed the leak on 7 July 2023, deliberately withheld the website's name because the data was still publicly accessible at the time of publication. Bangladesh's national Computer Incident Response Team (CIRT) and government press office did not respond to requests for comment before publication.

Impact

• The personal records of over 50 million Bangladeshi citizens were exposed — a figure repeated across Bangladeshi and international outlets.
• Because the data tied directly to the NID system, exposed individuals faced lasting risk of identity theft, SIM-swap fraud and impersonation, with no ability to "rotate" an immutable national ID number.
• The leak was an infrastructure and configuration failure, not a breach of a hardened system — making it both embarrassing and, in principle, entirely preventable.

Government response

The site was taken offline around 10 July 2023. Zunaid Ahmed Palak, then State Minister for Information and Communication Technology, publicly acknowledged the exposure but insisted it "was not the result of hacking," attributing it instead to "security weaknesses present in the websites." The government launched an inquiry into the scope of the exposure and which partner organisation was responsible, given that scores of agencies share access to citizen data.

Why it matters

Bangladesh had digitised vast amounts of citizen data without a mature data-protection law or uniform security baseline across the 170-plus organisations that tap the NID database. This incident — discovered by chance rather than by an attacker — exposed how a single misconfigured partner site can compromise the data of an entire population. It became the reference case in Bangladesh's debate over a national Data Protection Act and stricter controls on third-party access to government identity systems.