Massive data breach at Shwapno puts millions of customers at risk

Dhaka: One of Bangladesh’s largest supermarket chains Shwapno has fallen victim to a major cyberattack, exposing sensitive information of millions of customers. Hackers are reportedly demanding a ransom of USD 1.5 million (over BDT 18 crore) after gaining control of the company’s database.

Managing Director Sabbir Hasan Nasir revealed that the breach dates back to December last year, when attackers infiltrated the company’s website and internal systems. The incident only became publicly apparent after customer data — such as names, phone numbers, and purchase histories — began circulating online.

With more than 40 lakh registered users and over 800 outlets across 63 districts, the scale of potential exposure is significant. However, the company has not confirmed the exact volume of compromised data.

Customers have already raised alarm over the severity of the leak. One individual reported being able to retrieve detailed records, including transaction history, simply by entering a phone number — highlighting how easily accessible the data may be.

Shwapno, a subsidiary of ACI Limited, is now working with local and international cybersecurity experts, along with the Counter Terrorism and Transnational Crime (CTTC) unit, to investigate the breach and strengthen its defenses.

Despite the seriousness of the situation, the company has yet to issue a formal public warning. Nasir stated that the breach was only recently identified and emphasized that Shwapno will not engage with the hackers’ demands. Legal action is currently being prepared in response to the incident.

T