A cybercriminal entity operating under the alias “Mudarax” has listed a massive database containing the curricula vitae (CVs) of approximately six million Bangladeshi jobseekers for sale on an illicit dark web forum. The perpetrators claim the vast repository of personal and professional information was exfiltrated directly from Bdjobs, the leading employment and recruitment portal in Bangladesh. The company has strongly refuted these assertions, denying any compromise of its core digital infrastructure and urging the public to refrain from circulating unsubstantiated claims.
The illicit posting surfaced on an underground marketplace over the weekend, offering buyers unrestricted access to an extensive collection of sensitive citizen records. According to the seller’s description, the leaked records comprise full names, mobile contact numbers, physical addresses, and email accounts. The cache also reportedly contains detailed academic credentials, chronological employment histories, and specialised professional certificates. The hackers set a price tag of 1,000 US dollars for the entire compilation, specifying that the data would be sold to no more than five buyers to maintain its commercial value for downstream exploitation.
Financial transactions were requested through multiple alternative payment routes, including digital wallets and payment processing platforms such as Paytm, Wise, and PayU, alongside cryptocurrency transfers through Binance. Security specialists note that compromised personal details of this scale present substantial risks to private citizens, as illicit brokers frequently purchase bulk credentials to execute sophisticated social engineering scams, targeted spear-phishing attempts, identity theft, and automated account-takeover operations against banking services.
Bdjobs responded swiftly by issuing an official statement to address the situation, cautioning against rumours and distorted accounts circulating across digital media. The management stated that the platform enforces stringent data protection protocols and architectural safeguards designed to give registered applicants direct control over the visibility of their profiles.
The recruitment platform highlighted that access to jobseeker profiles is legally restricted to verified enterprise clients with active hiring accounts. Bdjobs issued a sharp warning that if any registered employer or recruitment partner is found scraping, transferring, or selling candidate information to unauthorised third parties, the company will initiate immediate legal action and terminate their access. Internal teams continue to review platform activity while advising users to remain vigilant against suspicious communications.
