Bangladesh Smart NID Telegram data leak

In October 2023, just months after a government website leaked the records of 50 million Bangladeshis, citizens' identity data resurfaced in an even more weaponised form: a Telegram bot that returned a person's full profile on demand. Anyone could feed it a 10-digit Smart National ID (NID) number and receive names, parents' names, gender, phone number, address and photograph in return.

What happened

On 3–5 October 2023, Bangladeshi journalists confirmed that a Telegram channel was running an automated bot connected to a copy of National ID data. The bot exposed the records of citizens holding Bangladesh's Smart NID card. The country's NID database covers roughly 12 crore (120 million) voters, of whom about 5.5 crore (55 million) hold smart cards — the population whose records were retrievable through the channel.

The Election Commission's NID Wing operates the master server, but access is shared with 174 partner organisations — banks, telecoms, ministries and agencies — each a potential leak point. Officials concluded the data had escaped through one of these partners rather than from the central server itself.

Impact

• Records of up to 55 million Smart NID holders were queryable through the Telegram bot.
• Because the bot keyed off the immutable NID number, the leak enabled targeted impersonation, SIM-swap and financial fraud at scale.
• The incident compounded the June–July 2023 Registrar General exposure, cementing a perception that Bangladesh's identity data was effectively public.

Official response

Mohammad Ashraf Hussain, system manager at the EC's NID Wing, said he had learned of the Telegram channel but did not know who was behind it. The NID Wing's director general initially said he was unaware of the matter and insisted "the NID server is safe." The Commission opened an investigation and, by December 2023, said it had found primary evidence implicating several institutions with NID access, including a state bank's mobile-money platform, a port authority and government directorates. In December 2024, the EC terminated its registration-data-verification contract with the Bangladesh Computer Council for breaching the access agreement.

Why it matters

The Telegram leak demonstrated the core flaw of centralised national-ID schemes: the security of 120 million citizens' data is only as strong as the weakest of 174 connected organisations. Once an NID number leaks, it cannot be reissued like a password. The episode intensified calls in Bangladesh for a binding Data Protection Act, granular access logging, and real accountability for the third parties entrusted with the population's identity records.