NID data leaks expose millions to identity theft, fraud

The personal information of millions of Bangladeshi citizens has been exposed through repeated data leaks involving the National Identity Card (NID) database and organisations authorised to access it. Despite several measures by the Election Commission (EC) to prevent such incidents, reports of leaked information being sold online continue to raise serious concerns over data security and accountability.

The leaked information includes names, dates of birth, addresses, NID numbers, photographs and signatures. Such details are reportedly sold through Facebook, Telegram, WhatsApp and websites for relatively small amounts.

An investigation by fact-checking organisation Dismislab, published in August 2026, uncovered an online market for personal information. It identified 10 active websites selling different types of data, including NID records, call detail records (CDRs), mobile phone locations, passport information and tax identification details.

The investigation also found more than 600 Facebook posts advertising personal information in a single month and 36 active Facebook groups where such offers appeared repeatedly.

In one test, a reporter paid Tk500 and obtained an NID document within 17 minutes using only a mobile phone number. The person's name, photograph and date of birth matched the actual records. In another test, three months of a mobile subscriber's call records were obtained for Tk1,050. However, Dismislab said it could not independently verify all sellers' claims about the sources of the information.

The EC controls the national NID database, which contains information on millions of citizens. More than 180 government and private organisations have agreements with the commission to use its identity verification service.

An official of the National Identity Registration Wing told The Daily Observer that NID data could not be leaked directly from the EC's software system. However, the official acknowledged that organisations receiving the information could be sources of leaks, adding that the commission remained alert and took action whenever complaints were received.

In February 2025, the EC found initial evidence of data leaks involving five organisations: the Directorate General of Health Services, United Commercial Bank's Upay, Chattogram Port Authority, the Department of Women Affairs and the government's iBAS system under the Finance Ministry.

The commission issued show-cause notices and sought explanations, saying further technical investigations were needed to establish whether the leaks resulted from deliberate actions or negligence.

In May 2025, it temporarily suspended NID verification services for Bangladesh Ansar and Village Defence Party and BRAC Bank after detecting further leaks. The NID wing said routine monitoring had identified the problem and investigations would be conducted to determine those responsible.

In February 2025, the commission also announced plans to change its verification system so that authorised organisations would receive only a 'yes' or 'no' response on whether submitted information matched its records, rather than access to citizens' personal details.

Experts and industry sources have identified two possible routes for data leaks: misuse of authorised access by insiders and security weaknesses in systems holding personal information.

A senior official of a mobile operator told The Daily Observer that some government agencies had access to important systems containing customer information. The official claimed that data had sometimes been taken outside approved procedures through access to government systems.

Information technology expert Sumon Ahmed Sabir said that access to real-time personal information would only be possible through the involvement of employees of relevant government agencies or if a third party managed to bypass the security of systems storing the data.

The risks extend beyond the central NID database, as organisations receiving information for verification may also retain copies in their own systems. Inadequately protected systems can therefore expose citizens' information to identity theft, financial fraud and other crimes.

Stolen details can be used to open accounts, register SIM cards, create false identities or commit financial fraud. Combined with other personal information, they can also make scams more convincing by allowing criminals to impersonate trusted individuals or institutions.

Experts particularly warn about the exposure of biometric information, including fingerprints and iris scans, which cannot easily be changed like passwords or phone numbers.

Concerns over the EC's own digital security resurfaced in February 2026 when a technical flaw in an online system exposed the personal information of around 14,000 journalists who had applied for accreditation for the national election. Their photographs, signatures, NID numbers, mobile phone numbers and media organisation details reportedly remained publicly accessible for around two hours.

Bangladesh enacted the Personal Data Protection Act in 2026 to regulate the collection, storage and use of personal information and provide penalties for violations.

However, Barrister Jyotirmoy Barua, a Supreme Court lawyer, told The Daily Observer that legislation alone could not ensure data protection. He called for stronger security systems and institutional capacity, warning that leaked NID details and biometric information could be misused because they cannot easily be changed. He stressed the need to prevent leaks, punish those responsible and protect victims from further harm.

Dr M Shamim Kaiser, a professor at the Institute of Information Technology at Jahangirnagar University, also emphasised limiting the information shared with authorised organisations. He said institutions should receive only what they need for specific purposes. A bank, for instance, may need to verify a customer's identity but not obtain details such as marital status.

The repeated exposure of citizens' NID information highlights that securing the central database alone is insufficient. Every organisation handling personal data must ensure restricted access, effective monitoring and accountability to prevent identity theft and financial fraud.