A cybercriminal collective operating under the moniker “Mudarax” has advertised the illicit sale of a massive database containing the curricula vitae (CVs) of at least six million Bangladeshi jobseekers on a dark web marketplace forum. The threat actors claim the vast repository of personal and professional records was exfiltrated directly from Bdjobs, the largest employment portal in Bangladesh. The company, however, has firmly dismissed allegations of a security breach within its internal infrastructure, urging users not to circulate unverified reports regarding compromised systems.
The illicit listing appeared on an underground forum on Sunday, offering prospective buyers access to an extensive assortment of sensitive citizen information. According to the sellers, the dataset includes full names, telephone numbers, residential addresses, and email contacts, alongside comprehensive educational backgrounds, employment histories, and professional training certifications. The entire tranche has been priced at 1,000 US dollars, with the cyber group stating that access would be restricted to a maximum of five individual purchasers to preserve the commercial utility of the records.
To facilitate the transaction, the vendors specified several digital payment gateways, including Paytm, Wise, PayU, and the cryptocurrency exchange platform Binance. Cybersecurity analysts frequently observe threat actors offering bulk personally identifiable information on unregulated forums, where data can be weaponised for targeted spear-phishing campaigns, identity fraud, and automated credential-stuffing exploits against financial and professional accounts.
Bdjobs addressed the incident through an official circular, clarifying that misleading and inaccurate narratives regarding its platform security were circulating across social media channels. The organisation emphasised that user privacy and data security remain at the forefront of its operational protocols, maintaining that robust security and privacy controls are embedded into the portal to ensure candidates retain complete control over who views their profiles.
Company officials outlined that authorised recruiting organisations possessing verified employer accounts are permitted to view applicant details on the platform. Bdjobs issued a stern warning against unauthorised redistribution, stating that should any registered recruiter attempt to transfer, scrape, or sell candidate details to third parties and be proven guilty, the company will initiate immediate legal proceedings against the offending entities. Platform representatives have reaffirmed their commitment to safeguarding candidate data as investigations into the source of the leaked records continue.
