Short answer
Pathao detected a cyberattack on 4 October 2026 and on 7 October confirmed that attackers obtained names, email addresses and phone numbers. It affected operations in Bangladesh and Nepal. Attackers claim 133 GB and 19 million users and demand USD 400,000, which Pathao says it has not verified.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Pathao |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Ride-hailing, delivery and payments |
| Country | Bangladesh and Nepal |
| Detected | 2026-10-04 |
| Disclosed | 2026-10-07 |
| People or records affected | Not disclosed by Pathao. Hackers claim more than 19 million user records (unverified). |
What data was exposed
- Names (confirmed by Pathao)
- Email addresses (confirmed by Pathao)
- Phone numbers (confirmed by Pathao)
- NID numbers, driving licence details, location data and home addresses (claimed by attackers, unverified)
- Employee records, admin credentials, merchant bank details and driver trip records (claimed by attackers, unverified)
What happened
Pathao, the ride-hailing, delivery and payments company, detected a cybersecurity incident on 4 October 2026 and took critical systems offline as a precaution. Services came back, though some users saw problems for a while. After a dark web claim circulated on social media, Pathao posted a statement shortly after midnight on 8 October (dated 7 October in some reports). It said “certain personal information, including names, email addresses and phone numbers, was obtained by malicious actors”, according to The Daily Star.
The company said it contained the incident when it was detected, brought in outside cybersecurity experts, and told the relevant authorities. It said the incident touched operations in Bangladesh and Nepal.
What the attackers say
The attackers’ claims are far larger than anything Pathao has confirmed. Prothom Alo reported a group claiming about 133 GB of data and 250 million records across 591 databases. The list includes mobile numbers, emails, NID numbers, driving licence details, location data, photos and about 5.7 million home addresses. The group also claims internal data such as employee records, admin credentials, merchant bank details and driver trip records. It demanded USD 400,000 and threatened to release NID, banking and administrative data if unpaid.
Pathao said it has not verified these claims and did not comment on the ransom demand. Neither report names the group. Figures of “19 million users” come from the attackers’ side and from press summaries of their post.
What Pathao has not said
Pathao has not given a number of affected users, how long the attackers had access, or how they got in. It has not addressed passwords, payment data or ID documents. Names, phone numbers and emails can make phishing more convincing, though Pathao has not reported that such attacks occurred.
Why contact details are enough for scammers
A name plus a working phone number lets a scammer open with “Hello, this is Pathao support about your last ride.” That is a believable start for an OTP theft. Our guide to phishing messages shows what to look for, and online shopping scams covers fake refund and voucher pages. If the extortion threat reaches you, read urgent payment scams first and do not pay. Our data breach checklist lists the steps to take.
What to watch for next
Cybersecurity expert Tanvir Hassan Zoha told Prothom Alo an independent forensic investigation, evidence preservation and notice to regulators and police are needed. Whether the claimed NID and address data is real will become clear if the group publishes samples. See more cases on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake calls or messages from 'Pathao support' or a rider, quoting your name and number, asking for an OTP, PIN or app login.
- Phishing links that copy Pathao refund, voucher or 'account verification' pages.
- Fake bKash, Nagad or eSewa messages that use your real phone number to ask for money or a 'security deposit'.
- Extortion emails or texts threatening to publish more of your data unless you pay, if NID or address data really leaked.
What to do if you are affected
- 01Treat any unexpected call, SMS or email about Pathao with suspicion. Pathao says users should never share passwords, PINs or OTPs with anyone who contacts them.
- 02Change your Pathao password and any other account that uses the same one. Turn on two-step verification where offered.
- 03Do not pay anyone who says they hold your data. Do not reply to extortion messages. Save them as evidence.
- 04In Bangladesh, call 999 for urgent help with threats, and report fraud to your local police station or the police cyber unit. In Nepal, report cybercrime to the Nepal Police Cyber Bureau.
- 05If you shared a mobile wallet PIN or OTP, contact your wallet provider (bKash, Nagad, eSewa or Khalti) immediately to block the account.
Frequently asked questions
What data did Pathao confirm was stolen?
Names, email addresses and phone numbers. Pathao has not said whether passwords, payment details or ID documents were involved.
Did the Pathao breach affect Nepal?
Yes. Pathao spokesperson Md. Foyej said the incident affected operations in both Bangladesh and Nepal, according to The Daily Star. Pathao has not said how many users in each country are affected.
Are NID numbers and driving licences exposed?
The attackers claim so, but Pathao says it has not verified those claims. Treat NID and licence data as possibly exposed and watch for identity-based scams.
Was a ransom demanded?
A group demanded USD 400,000 in USDT, according to the reports. Pathao declined to comment on the demand because it is unverified.
Can I still use the Pathao app?
Pathao took critical systems offline on 4 October and restored services soon after, though some users saw intermittent problems. Check the Pathao app and official channels for current status.
Sources
- Pathao says cyber attack exposed users' names, emails and phone numbers, The Daily Star, 2026-10-08
- Pathao data breach: Hackers claim data of 19 million users, Prothom Alo English, 2026-10-09
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.