Socio-financial impact of data breach

This article was first published on New Age on April 09, 2026

THE largest supermarket chain Shwapno, which has more than four million registered consumers, has said that its customer database was breached towards the end of March and cybercriminals demanded $1.5 million, which comes to more than Tk 183 million. The chain shop made the disclosure after its consumer details — names, phone numbers and purchase history — did the rounds on social media. The management of Shwapno, a subsidiary of ACI Limited, worked with forensic experts and the Counter Terrorism and Transnational Crimes unit and took steps to secure its system.

The most dangerous aspect of such breaches remains the casual attitude of customers, many of whom may think it does not matter if names, phone numbers and shopping history do the rounds in the public domain. They are no simple pieces of information. Combined, they form a context-rich ‘target profile’ of people. The shopping history could indicate dietary habits, interests, income range, salary in time, household size, marital status, health choices and even religious or cultural practices.

The purchase pattern analysis can also show the days of financial strain by looking into the switch to low-cost brands or less buying. Research shows that shopping data can also reveal pregnancy before women make the announcement and explore the status of mental health without access to any single medical or personal record. All this can make buyers susceptible to loan scams or emotional manipulation. The leaked information together makes a map that skilled social engineers, scammers or profilers can exploit with remarkable precision. Modern machine learning tools can make startlingly accurate predictions from purchase data alone.

People with declining purchase in the last week of a month, which suggests weak cash flow, might receive predatory loan app advertisements. And the victims would rarely realise the attack was designed specifically for them. They often think that they had bad luck with scammers. But they were, in fact, products of a data-driven targeting exercise. What is the most ominous part of the story is that behavioural profiles that once make it to the market do not expire. They remain there, getting updated with other leaked data and becoming increasingly accurate over time and exploited by criminals, big companies and social engineers.

Physical safety risks are, perhaps, the most overlooked aspect of this. The purchase history, which might show a woman shopping alone late in the evening with young children on specific days, can help criminals in kidnapping, stalking or even targeted home invasion. Criminal networks that buy leaked databases on the darknet not only include scammers, but they also include physical crime rings. Reputation and relationship damage is also possible. Some purchase history might show habits or preferences undisclosed to the family. Shopping patterns could be used to infer or fabricate narratives about private life for blackmail, coercion or harassment. Phishing is also possible by using real data to manufacture trust.

The Cambridge Analytica episode suggests that the most sophisticated exploitation of personal data happens in daylight. Facebook data were harvested and used to build psychological profiles of millions of voters in the United States and the United Kingdom. The profiles identified each person’s fears, aspirations, spending habits and emotional triggers. Targeted political advertisements were then crafted to reach each person with messages tailored to specific psychological profiles. This is a textbook example of behavioural manipulation. A company, which may not operate in Bangladesh, might use the purchase data of the four million people at hand to build detailed profiles of consumption and the way of life. The profiles could be sold to insurance companies, which can price premiums discriminatorily based on inferred health habits. They could be sold to political operatives who want to microtarget voters before elections. They could be sold to lending institutions, which can use the inferred incomes and spending patterns to approve or deny credit. None of the tasks requires ‘hacking.’ The data leaked are more than enough for such tasks.

Mobile financial services are embedded in daily life. Criminals equipped with profiles of likely victims can convincingly deceive them into sharing one-time passwords or personal identification numbers, and the victims can lose their entire mobile wallet balance in minutes. In Bangladesh, the recovery of such funds is extremely difficult. Criminals can also open accounts with the leaked profiles, apply for microloans on digital lending platforms or register for credit services. Given that many digital lending platforms rely primarily on mobile number verification, the risk is real. Victims may only discover the fraudulent accounts when lenders begin making calls for repayment.

Under the European Union’s General Data Protection Regulation, which is the global standard for data protection law, companies that fail to protect customer data can be fined up to €20 million or 4 per cent of their global annual turnover. The regulation also gives individuals the right to claim compensation for both material and non-material damage caused by a data breach. Non-material damage may include distress, anxiety and the loss of control over one’s personal information. In Bangladesh, there is no comprehensive data protection law. The Digital Security Act 2018 and its successor, the Cyber Security Act 2023, criminalise unauthorised data access but they do not offer a private right to claim damages. This is a significant gap that leaves four million Shwapno customers legally unprotected.

Whilst Shwapno faces investigation costs, legal fees for filing cases, fees for domestic and international forensic experts and the cost of rebuilding its cybersecurity architecture, its competitive advantage partly rests on its loyalty programme, which is the database that was breached. When consumers feel that enrolling in a loyalty programme exposes their personal data, they become reluctant to participate. A loyalty programme degradation directly reduces customer value and the company’s ability to run data-driven promotions. Reputational damage of this scale can also affect investor perception of its owning company.

The breach checker that circulated online after the Shwapno hack has already received more than 100,000 page views. Security analysts warn that using such third-party checkers may expose users to further data harvesting. Consumers can also change the passwords of mobile banking apps, e-commerce accounts or any platforms that use the leaked phone numbers as a verification tool. If the number is in the leaked database, attackers know which number to target for one-time password harvesting. Consumers might also be victims of SIM-swap attempts. They can request mobile operators for additional identity verification requirements before any SIM-related changes are processed. Consumers should also be critical about calls that reference personal details even if the caller claims to be from a legitimate company.

The Shwapno breach brings to the fore both a technical failure and a governance failure. On the technical side, companies that handle large volumes of customer data must implement layered security architecture. It may include multi-factor authentication on all administrative access points, end-to-end encryption of stored customer data, routine penetration testing by independent third parties and real-time intrusion detection systems that flag anomalous behaviour in a network immediately. The principle of data minimisation — collecting only what is necessary — should govern every system. If a loyalty programme does not operationally require purchase histories to be stored indefinitely, they should be deleted periodically.

On the governance side, companies need a clear incident response plan, rehearsed regularly, that includes a mandatory, time-bound customer notification protocol. In Shwapno’s case, the details of how the breach occurred have not been made public, but the reality of retail supply chains is that data flow through a large number of people and systems — point-of-sale terminals, third-party logistics partners, marketing agencies, app developers and more. Every person in the chain who has access to customer data is a potential point of breach. Training must, therefore, be continuous, role-specific and treated as a business-critical function rather than an annual compliance check.

The government must put in place a comprehensive personal data protection law modelled on standard practices such as the principles of the European Union’s regulations, but tailored to Bangladesh’s context. Consumers should at least have the right to know what personal data companies hold, mandatory breach notification within a defined time frame, the right to seek compensation for data negligence, mandatory data protection impact assessments before the launch of digital platforms and independent oversight by regulators with genuine investigative and penalising powers.

Bangladesh has already experienced multiple large-scale data exposures — the national identification registry database, birth registry records and now the loyalty database of a private retailer. Data are a responsibility and they are exchanged in trust. Bangladesh, therefore, needs laws, institutions, corporate practices and public awareness to protect personal data. The Shwapno breach is a wake-up call.

      Ishtiaque Foysol is a freelance security researcher and trainer at Decodes Lab Ltd.

Myths and reality of a parallel world’s defence mechanism (2019)

An AI generated image

The article was published in the Youth page (now defunct) of New Age on August 18, 2019

Going down the rabbit hole

Where am I when I'm not in reality or in my imagination?

— Domenico in Andrei Tarkovsky’s ‘Nostalghia’

APART from the 90s hacker movies to the recent Noah Harari’s prophecy, a conscious observer cannot deny that the line between ‘real’ and ‘virtual world’ has become greyer as Elon Musk ‘reveals brain-hacking plans’ and Facebook ‘funds AI mind-reading experiment’.

On the one hand, creative criminal minds around the world are not only manipulating these sophisticated latest technologies or the devices connected to the internet, but the human brains in forms of pornography, blue whale challenge, triggering communal unrest using manipulated religious photos (Nasirnagar in Bangladesh on October 30, 2016), engineering elections in different countries or recent trend of spreading rumour over social media that claimed a number of innocent lives in lynching.

On the other hand, tech giants like Google and Facebook are also accused of stealthily mining users’ various forms of data, instead of gold, that would be invaluable in near future to exploit a huge number of human beings for social, economic and political purposes, according to experts.

Once science fiction or luxury has become inevitable part of life and the differences between human and machine are transforming into similarities.

All these issues have triggered the necessity of acquiring at least basics of how to live in the parallel universe of cyber world — the playground of ‘Mad Hatters’ and ‘Mad Haters’.

Hackers, cyber criminals and cyber security

MOST of us, blinded by the media and movie industries, often misinterpret the terms hacking and cybercrime by using them interchangeably. It is also hard to keep pace with the leapfrogging shiny technologies and harder to get deeper knowledge about how do they work under the hood.

So, the realm of cyber security remained vague as the aforementioned terms are closely related to it.

Let us start with some myth busters. Firstly, hacking is not something that is represented in movies and media; at all.

According to Richard Stallman, founder of Free Software Foundation and GNU project (to be precise the real Santa Claus), ‘playfully doing something difficult, whether useful or not, that is hacking. You can help correct the misunderstanding simply by making a distinction between security breaking and hacking — by using the term ‘cracking’ for security breaking. The people who do it are ‘crackers’. Some of them may also be hackers, just as some of them may be chess players or golfers.’

Hacking, apart from the technical world, also fits perfectly in arts, music, sports; each and every human activity being done from the ancient time.

Eric S Raymond, a hacker culture Zen Guru, says, ‘There are people who apply the hacker attitude to other things, like electronics or music — actually, you can find it at the highest levels of any science or art. Software hackers recognise these kindred spirits elsewhere and may call them ‘hackers’ too — and some claim that the hacker nature is really independent of the particular medium the hacker works in.’

Cyber security, in reality, deals with security in cyberspace, a networked world of humans and machines, where playful and professional hackers are continuously fighting with criminals to protect computers, networks, programs, data and most importantly humans from unauthorised accesses, manipulations, exploitations and attacks that are aimed for any form of harm.

Humans are, above all, the most sophisticated creatures developing technologies for their ease of living from the ancient time. Cyber criminals thus target two things — humans and the technologies.

The first one is social engineering while the later is digital forgery. In movies we are mostly misled by the over representation of digital forgery while the social engineering, that often comes more devastating — is mostly ignored.

Workplace of Beetles, a Bangladeshi cyber security firm

Hacking as passion and profession

MD MUQEET Halim, chief executive officer of Bangladeshi cyber security firm Beetles, talked to New Age Youth as a cyber-security professional and shared his first-hand experiences.

‘Real hacking is totally different from what we watch in movies. For one thing, it is not possible to manually brute-force a 128 bit encryption as seen in the movie ‘Swordfish’. Also, there is no intense background music when we work. There is a lot of background work, understanding of the technology and research that goes behind each of our testing cases,’ he said.

‘A cyber criminal may be someone next to us in a public place or workplace’s cafeteria, or anywhere in the planet earth definitely not someone in hoodies, typing lightning fast random codes on a keyboard in a dark room.

Also, we do not really do all our work on a black screen with green binary sequences running up and down,’ Muqeet added.

According to him, the professional life in cyber security differs from the traditional concept of job. For regular professionals it is a regular job with good working hours while for the pen-testers or the hackers like flexibility in working hours and job conditions that naturally differs from Bangladeshi norms.

Security professionals, moreover, have a great responsibility to their clients and industry as they have to deal with a lot of confidential and sensitive data.

They must adhere to high moral standards and not to be compromised even accidentally, said Muqeet adding, ‘If we slip off, we put the client at risk and that is a burden we must bear.’

He explains the passion of the profession, ‘It is great. We get to break down walls and bypass security measures! It is interesting, challenging and at times highly frustrating and we love it. There is nothing like the thrill of implementing your own exploits and gaining access to a system, or from being able to correctly guess a password and bypassing controls.’

Marketplace, cyber security in Bangladesh and opportunities for youths

ACCORDING to Muqeet, importance of cyber security have drawn attention after the Bangladesh Bank heist in 2016 although people have been working in this sector in Bangladesh for long.

More people are online, businesses are moving towards the cloud technology as well as Bangladesh is becoming a global go-to hub for IT outsourcing and support.

Recent incidents have proven that technologically booming Bangladesh is becoming a regular target of cyber criminals from around the globe and this will increase.

‘But we must not let this deter us from the path that we are on, instead, we need to grow cyber awareness and more businesses need to realise the importance of spending on cyber security. Along with digital Bangladesh, we need to grow digital security,’ said Muqeet, the cyber security expert adding, ‘From our experience of having worked with over 30 clients for the past two years, in various industrial sectors, including the financial, we are overall weak and vulnerable to any major cyber incident.’

‘Due to lack of skilled resources with proper subject matter expertise, we tend to overspend on nonessential items and prioritise them as well, trying to go with the ‘recent trend’, in comparing us with a market with a more overall cyber security maturity.’

When asked about the academic background and certifications needed for youths interested to enter into this adrenalin pumping profession he said that their company looked for people with logical problem solving skills and passion in cyber security. They do not look for any specific academic educational background nor give any high importance to certifications for pen-testers as ‘the profession is all about skills that one accumulates and sharpens.’

What bare minimum everyone must know

CYBER security is all about protecting both human and electronic resources/data from unauthorised local and remote access, change or destruction.

Confidentiality, integrity and availability — known as the CIA triad — are the basic of cyber security.

Confidentiality means to keep the data private, only accessible to people it is meant for. Integrity is to ensure that the data, or the system itself, cannot be altered or changed without proper authorisation. And availability is to ensure that the system can be used when desired or as designed, explains Muqeet adding, ‘This is what any cyber security firm does. We ensure the CIA triad of an organisation. Recently though, it is now also practical to add another property, resilience, what ensures that a system will endure security threats, in the event of an incident, instead of critically failing, because, regardless of what happens, the business must go on.’

People, process and technology are inevitably connected to each other while in most cases people are the weakest among them. They have a tendency to go to random sites, clicking random links from unknown senders, providing personal data to invalidated sites in the hopes of a discount, using free Wi-Fi and then use that same device within the corporate network et cetera possess cyber threats.

Experts suggest end users for not to use public Wi-Fi and using easy to guess passwords like ‘password1234’ or mobile number and writing them down in diary, using two factor authentication and practicing good cyber hygiene for their security.

Muqeet also emphasised auditing IT infrastructure like that of an external financial audit once a year. 

Uncanny social engineers: blue pill, red pill and the one mama gives

You have to understand, most of these people are not ready to be unplugged. And many of them are so inured, so hopelessly dependent on the system that they will fight to protect it.

— Morpheus to Neo in Matrix by Wachowski siblings

MOHAMMAD Asif Chowdhury, lecturer at the department of international relations of Gono Bishwabidyalay, talks about the gray line between the social and cyber world which is often exploited by social engineering — the extremely powerful tool often ignored by film and media.

‘When we talk about social engineering, some ideas come to our mind and those are manipulation, deception, influence, brain wash, propaganda, mob psychology, sense of insecurity et cetera. But the real thing is that society uses engineering to cope with new situation,’ he says.

According to Mohammad Asif, education policy has to be considered as social engineering too. Textbook contents to TV advertisements — everything is in the realm of social engineering.

‘At first I heard about social engineering from Karl Popper, professor at the London School of Economics and Political Science. He wrote several books on political philosophy. The most renowned of them is his 1957 book The Poverty of Historicism, in which he criticised historicism and proposed social engineering. By social engineering he means small changes are made to society in order to cope with the unpredictable future. Critics may term it the anti-communist propaganda. But many thought it is for the development of society.’

‘It may direct from political entities namely political parties or government or from social entities namely social leaders, religious leaders, sect leaders,’ said Asif Chowdhury, also a teacher of department of politics and governance of GB.

But these days, the meaning of social engineering has changed drastically. It has become the means of those who are commonly known as ‘hackers’. It has become the art of deception as popularised by Kevin Mitnick. Hypnotism, deception, manipulation and neuro-linguistic programming et cetera are attached to social engineering and make it more suspicious.

In recent time, social media takes the place of popular media. Its contents, freedom of the users and other flexible features contributed to its immense popularity. At the same time it also has some very dangerous security concerns, according to Mohammad Asif.

Personal securities as well as public securities are in danger when virtual and actual world are merged together. One such example is the recent series of lynching incidents took place in various parts of Bangladesh and India over child lifting rumours.

Cyber criminals make things viral on Facebook and YouTube. The rumours spread to the real world and there are some instances where people are killed by angry mob. ‘It is painful and pathetic that we are living in the very twenty first century with such stupidity. Social engineers (in positive sense like hackers) have to find out the causes behind this and law enforcers would take them away from the society,’ said the Gono Bishwabidyalay teacher.

In the past, politicians like Hillary Clinton and Donald Trump heavily relied on social engineering in order to capture political power by being elected as president of the United States of America. They assigned Facebook and other social media to reach and manipulate voters.

In the UK’s Brexit vote, one of the lethal weapons was Facebook. The social media secretly collected users’ social behavioural patterns, thought process and manipulated them in order to make Brexit possible.

In many instances marketing tactics like ‘micro-targeting’, ‘A/B testing’, ‘narrowcasting’,  ‘choice modelling’ and ‘discrete choice model’ were assigned to influence social media users and they became weapons of mass manipulation, said Asif Chowdhury.

Academic study, professional training

TO KNOW about university programmes offered on cyber security, New Age Youth have contacted Dr Md Shariful Islam, professor and director of the Institute of Information Technology, University of Dhaka.

He says that the basics are taught in the regular courses like software security and other security related ones. ‘So, we have no specific department on cyber security. However, the students later develop their skills in professional life or through specialised trainings,’ Shariful Islam said adding that in every batch some of their students do research work on computer security fields.

Some globally authorised centres in Dhaka provide trainings and arrange international standard examinations like Certified Ethical Hacker (CEH) among others.

Certified Ethical Hacker, trademarked as CE|H, is an International Council of Electronic Commerce Consultants (EC-Council) authorised training-examination.

This is one of the most advanced ethical hacking courses that cover 20 of the most important security domains consisting of hacking techniques and tools used by hackers and information security professionals.

The CEH is a specialised training course for professionals like pen-testers, system administrators, network administrators, web managers, auditors and security professionals in general.

Selim Reza, assistant manager (education) of IBCS-Primax, says about the course details. IBCS-Primax is an EC council and ComTIA authorised training centre in Dhaka that provides CEH training and arranges online exam.

It is now providing the CEHv10 training that mainly focuses on security of cloud computing, mobile platforms, Internet of Things (IoT), backward compatible operating systems and newer vulnerabilities.

The 40 hour course costs Tk 50,000 that includes exam costs (excluding VAT and Tax), said Selim Reza adding that an examinee must obtain 70 per cent marks to pass the four hour examination by answering a total of 125 multiple choice questions.

New Horizons CLC, Dhaka, the franchise of New Horizons Computer Learning Center Inc, Conshohocken, Philadelphia, USA, also offers CEH and other security trainings. Their website contains a precise ‘career map’ for cyber security enthusiasts.

Md Majedul Islam, centre-in-charge of New Horizons CLC Gulshan Branch informed about the syllabus. ‘The institute teaches students, like other training centres, the core 20 modules of  CEH that include, among others, Footprinting and Reconnaissance, Scanning Networks, System Hacking, Trojans and Backdoors et cetera,’ he said.

User end hackers

THE necessity and popularity of free and open source software is gradually gaining vibe among youngsters in Bangla speaking communities.

Availability of faster internet ensured access to do-it-your own videos, open source forums and groups on various social platforms that enabled them to interact closely on problems and sharing solutions/codes that have established them as the user end hackers.

The FOSS people, mostly the GNU/Linux enthusiasts, are more concerned on their security and prefer to develop script or configure their tools according to their taste and geeky interest.

Kuntal Kundu, a FOSS enthusiast from Balurghat India, shares his experience. ‘I prefer authorised websites for browsing and prefer VPN for suspicious ones, torrent sites mainly. I read the review before installing any program. VLC player, Libre Office, Probhat, GIMP, Inkscape and Darktable are some of my necessary tools.’ he said.

One practice is common among them which is not installing any software or run script at once as well as keeping the system minimal which in turn assures an optimised and easy to administrate environment.

They are patient enough to take time to pin point any issue, read documents before installing any software and review scripts or commands before executing. This enables them to maintain the hygiene of the system and becoming a power user.

Saumen Roy, a computer science student of Chittagong University of Engineering and Technology, said, ‘I don’t use any unnecessary packages (software) however mx is most complete distro I have ever seen with lots of extra utilities.’

An English literature major from Government Titumir College, Sammay Sarker says that the default configurations of system and network devices are usually safe. He rather thinks that humans are most vulnerable to cyber threats and emphasised the responsibilities of the users.

He focused on being careful of choosing browser add-ons and learning blocklist syntax on ad-blocks for fine tuning a safer internet surfing.

Sammay also suggests using different passwords on different platforms, using temporary email accounts, instead of main email account, for trivial works, using a reliable password manger to keep passwords safe — KeePass is his favourite and also uses GNU Privacy Guard (GPG) for sharing files or storage on mutual consent.

The self taught hacker is more focused on keeping the system free from unnecessary and resource hungry packages that depends heavily on more packages.

He said, ‘I always look for simple, lightweight programmes and try to read the documentation before installation rather than blindly following instructions available on internet. I always read the changelog before any upgrades. I always keep track of which packages are installed and remove dependencies after the build process.’

He emphasised reading documentations, manuals and keeping an eye on relevant websites like reddit, hackernews et cetera.

For local area network security Sammay uses Openwrt on router, keeps unnecessary ports closed, turns router’s broadcast SSID off and configures firewall for further security.

He says, ‘Most of the solutions are reading the manual and learning the duck-foo or stack-foo.’

Samnan Rahee, a computer science student of Dhaka University, also echoes Sammay and says that he tries to check dependencies before any installation and uses mostly Python to script his own tools.

Epilogue

Awakening is not a thing. It is not a goal, not a concept. It is not something to be attained. It is a metamorphosis. The caterpillar must accept its own disappearance in its transformation. When the marvellous butterfly takes wing, nothing of the caterpillar remains.

― Alejandro Jodorowsky

Filtering information from media and search engines is one of the most important skills to master to survive in the cyber world.

Then comes playing with the devices and operating systems of interest, breaking it — messing up configurations, running arbitrary codes, disassembling hardware — and being solely responsible for making it alive; except living things, they are fragile and might bring collapse like the doom day.

Some tips for enthusiasts

MAKING Quora, Reddit and Stackoverflow a bed-mate; getting detailed answers, being humiliated and filtering to the point technical details from there, in respective order.

One could keep hard copies of reference books of favourite system and languages — human and programming.

An extra plus for keeping Jibanananda Das and Sigmund Freud on book shelf, along with The Art of Deception by Kevin Mitnick and William L Simon, Hacking the Hacker: Learn From the Experts Who Take Down Hackers by Roger A Grimes and UNIX System Administration Handbook by Nemeth, Snyder, Hein, Whaley and Mackin, Social Engineering: The Art of Human Hacking by Christopher Hadnagy among others.

Bookmarking the blogs of Richard Stallman, Julia Evans and Eric Raymond, also the Gentoo and Arch Linux wikis — they are gory, detailed, vast and enlightening.

Reading blogs of Daniel Miessler and Brian Krebs are highly encouraged.

Acquiring basic knowledge on C and Python to feel how Prometheus — Denis Ritchie and Guido van Rossum — snatched fire from heaven.

If skies are too high or too slow (Tarkovsky and Jodorowsky), watching the masterpiece of Wachowski siblings — the Matrix trilogy once again trimming off the technical showoffs.

They are vast and philosophic; and avoiding unabated porn surfing — it is unhygienic in both the cyber and real world.