A hacker group operating under the alias “Madrrax” has put the resumes of nearly six million Bangladeshi citizens up for sale on the dark web, claiming the data was extracted from Bangladesh’s leading job portal, Bdjobs.
The group posted the listing on the cybercrime marketplace “darkforums.ru,” asking $1,000 for the full dataset and stating they plan to sell it to only five buyers. The exposed records reportedly include sensitive personal details such as full names, contact numbers, home addresses, academic records, training histories, and complete employment backgrounds.
To back their claim, Madrrax released a sample of 148 resumes for free download. A review of these files showed a consistent layout identical to Bdjobs’ standard CV format, covering both male and female job seekers. Contacting individuals listed in the sample confirmed their details matched their actual profiles hosted on Bdjobs, though none had been notified of any data breach.
Bdjobs management, however, dismissed the claim that its servers had been hacked.
“We are not aware of any breach in our database. If that had happened, we would have known first,” said Fahim Mashroor, Chief Executive Officer of Bdjobs. He suggested that third parties might have gathered the data legitimately through paid employer accounts or scraped publicly available profiles on networks like LinkedIn. “Some people try to exploit our brand name for illicit gains,” Mashroor added.
Cybersecurity experts strongly pushed back against that explanation.
“It is unrealistic to suggest someone bought six million CVs commercially or scraped a dataset of this scale from LinkedIn to flip on the dark web,” said Abdullah Al Jaber, an ethical hacker and director at Cyber 71. “LinkedIn’s automated defences are far more robust, and the identical formatting points toward a single bulk leak.”
Jaber warned that the exposed data poses severe risks to millions of citizens, leaving them vulnerable to identity theft, financial fraud, and targeted phishing scams. He advised job seekers to stay alert against unsolicited phone calls, suspicious links, and unexpected email attachments.
Source: Asia Post
