153K Rows of Applicant Data Leaked from erecruitmentdwasa.org

Data Breach Overview

In September 2025, a user known as frog published a leaked dataset on LeakBase containing applicant data from erecruitmentdwasa.org, the official recruitment portal of Dhaka Water Supply and Sewerage Authority (DWASA). The exposed CSV file contains 153,396 rows, corresponding to approximately 100,000 unique individuals who applied through the platform.

The leak was shared with credit to “Nick Diesel” and includes detailed personal and application-related information.

---

Where Was the Data Found?

The breach was discovered circulating on LeakBase.la, a known platform for data leak publications.

The leaked dataset is in CSV format and includes fields such as:

• Full names (in English and Bangla)
• Email addresses and phone numbers
• National ID numbers
• Dates of birth
• Parent names
• Home addresses (both permanent and present)
• Application statuses
• Uploaded file references (photos, signatures, NOC documents)

The filenames indicate that sensitive documents such as ID photos and signatures were stored or referenced in the system, increasing the potential risk of identity misuse.

Company Data Breach History

There are no publicly documented prior breaches involving erecruitmentdwasa.org. This appears to be the first known data exposure related to Dhaka WASA’s online recruitment system.

---

Impact and Risks

The leaked dataset contains highly sensitive personal data, placing affected individuals at risk of:

• Identity theft and impersonation using national ID numbers and personal documents
• Phishing attacks via exposed emails and phone numbers
• Fraudulent job offers or scams targeting applicants
• Credential stuffing if emails and associated login data are reused elsewhere
• Reputation damage for both applicants and the organization

The leak also undermines public trust in government-run digital services, especially those handling employment data.

---

Recommendations for Users

If you have applied through erecruitmentdwasa.org, take the following steps:

• Change passwords associated with your email and any accounts used for the application
• Enable two-factor authentication (2FA) wherever possible
• Be cautious of phishing attempts or unsolicited messages
• Monitor financial and government accounts for unusual activity
• Request data deletion from the platform if applicable
• Report the incident to Bangladesh’s Digital Security Agency or relevant data protection authority

What is InsecureWeb?

InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.

Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.