New Report Reveals 68 Major Data Breaches Across Bangladeshi Public and Private Sectors Since 2023

Bangladesh has experienced a significant escalation in data breaches over the past three years, exposing sensitive information ranging from national identification (NID) cards and passports to bank records and personal call logs. According to a recent report by the TechGlobal Institute (TGI), at least 68 major data breaches occurred between January 2023 and May 2026, highlighting a systemic failure in institutional accountability and cybersecurity infrastructure.

The report, titled “Breached and Unanswered: Bangladesh’s Data Breach Epidemic (2023–2026),” reveals that 36 government agencies and 32 private organizations were compromised during this period. The frequency of these incidents has surged, with 7 breaches recorded in 2023, 27 in 2024, 14 in 2025, and 20 in the first five months of 2026 alone. TGI data indicates that government entities were the primary targets in most years, with the exception of 2024.

TGI’s Bangladesh head, Fauzia Afroze, emphasized that while data protection is a core state responsibility, the existing legal framework and accountability mechanisms remain critically flawed. The report identifies that most organizations lacked the capacity to detect breaches independently. In the majority of instances, authorities only became aware of the compromises after being alerted by external cybersecurity researchers, media outlets, or dark web monitoring firms.

The breaches were most prevalent in utility service providers, which accounted for 20 incidents, followed by private companies and business conglomerates. Other impacted sectors included the Election Commission, telecommunications providers, the armed forces, and financial institutions. Researchers noted that even when vulnerabilities were reported—such as an incident where administrative passwords for a government portal were publicly exposed—the response times and security protocols were insufficient.

The National Cyber Security Agency (NCSA), tasked with overseeing nearly 36,000 government domains, acknowledges the severity of these gaps. NCSA Director General Md. Tayebur Rahman admitted that many government portals have historically suffered from poor hosting and security management. While the agency is working to centralize hosting services under the Bangladesh Data Center Company Limited (BDCCL) to implement multi-layered security, Rahman noted that a chronic shortage of skilled technical personnel across government departments remains a significant risk.

International Crimes Tribunal Orders Jail for Air Force Wing Commander Saifur Rahman in Ilyas Ali Disappearance Case

Read Article

High-profile incidents, such as the unauthorized access to NID databases and allegations involving the National Telecommunication Monitoring Center (NTMC), underscore the risks associated with internal access. The TGI report highlights that approximately 500 officials across 42 government agencies possess the authority to access sensitive citizen data for investigation purposes, which complicates efforts to prevent misuse. Furthermore, records concerning migrant workers—containing passport, NID, and financial documents for over one million individuals—have faced multiple infiltration attempts.

Despite the enactment of the Personal Data Protection Act, 2026, which mandates reporting of data breaches, TGI analysts remain skeptical. The report argues that the legislation offers broad exemptions for state agencies, suffers from implementation delays, and fails to establish robust enforcement mechanisms. Most breaches in Bangladesh are attributed not to sophisticated cyber-attacks, but to administrative negligence, lack of access control, and the absence of regular security audits.

Professor B.M. Moinul Hossain of the Institute of Information Technology at the University of Dhaka warned that the country is essentially leaving highly valuable information exposed. He stressed that simply holding awareness seminars is no longer sufficient; the government must enforce strict adherence to internationally recognized data protection standards and ensure that institutional accountability is not merely a formality, but a strictly enforced requirement.