Pathao says cyber attack exposed users' names, emails and phone numbers

Pathao, one of Bangladesh’s largest ride-hailing and delivery platforms, said on October 7 that malicious actors had obtained some users’ personal information after a cybersecurity incident disrupted services earlier this week.

The company said the incident occurred on October 4 and prompted it to take critical systems offline as a precaution. Pathao said its services were restored shortly afterwards, although some users could continue to face intermittent problems as the company worked to stabilise its systems.

The company did not say how many users were affected or disclose how the attackers gained access to its systems.

Pathao confirms personal information was obtained

In a statement posted on on October 7, Pathao said it had detected a cybersecurity incident and taken immediate action to contain it.

“We understand that certain personal information, including names, email addresses and phone numbers, was obtained by malicious actors,” the company said.

The statement is the company's first public confirmation that personal information was obtained during the incident.

Pathao did not say whether other categories of personal information had been accessed. It also did not disclose whether passwords, payment information, identification documents or other sensitive data were involved.

The company said it had engaged external cybersecurity experts to strengthen its security measures and assist with the response.

“Immediate containment measures were taken, and external cybersecurity experts have been engaged to reinforce security controls and help ensure Pathao's systems remain secure and stable,” Pathao said.

It said relevant authorities had also been informed and that it was cooperating with them while the investigation continued.

Company warns users possible scams

Pathao also warned users to be alert to attempts to exploit the incident.

“We urge users to remain cautious of unsolicited messages, calls or links claiming to represent Pathao, and should never passwords, PINs or OTPS in response to such communications,” the company said.

The warning comes as the company investigates what information was obtained. Names, phone numbers and email addresses can potentially be used to make phishing or impersonation attempts appear more credible, although Pathao did not say that such attacks had occurred.

The company said users should rely on its official channels for further information.

“Verified updates and guidance regarding the incident will be shared through Pathao's official channels,” it said.

Scope of breach remains unclear

Pathao has not disclosed the number of affected users, the duration of any unauthorised access or the method used to compromise its systems.

The company also has not publicly confirmed claims circulating online a substantially larger dataset allegedly taken from its systems.

At the time of reporting, Pathao had not responded to requests for separate on the incidents.

For all latest news, follow The Daily Star's Google News channel.