A cyber extortion attempt involving supermarket chain Shwapno has drawn attention to customer data security after customer information, including names, phone numbers and purchase histories, reportedly surfaced on social media.
Shwapno Managing Director Sabbir Hasan Nasir said an international cybercriminal group demanded $1.5 million from the company in August 2025, threatening to hack its systems and publish customer data if the money was not paid.
“We did not accommodate any kind of extortion demand because we believe such matters should be handled legally,” he told TIMES of Bangladesh.
He said the attackers did not initially provide proof of any breach, prompting the company to inform ACI Limited MIS department and review its internal systems.
ACI Limited MIS team then strengthened server-side and internet protections, renewed firewalls and antivirus systems and conducted penetration testing to assess cyber defences, he said.
The issue resurfaced in March when some customer data was allegedly found on the dark web, prompting the company to notify law enforcement authorities, Nasir said.
Shwapno informed Dhaka Metropolitan Police Counter Terrorism and Transnational Crime unit and moved to file a case with Tejgaon Industrial Area Police Station, while engaging local and international forensic experts, he said.
Findings so far suggest the exposed data is linked to the August 2025 incident and does not include recent customer information, he added.
“Latest data is not there, which means it is now protected,” he said.
In a separate statement, ACI Logistics Limited said international ransomware groups had demanded the ransom on August 20, 2025 but the company refused to negotiate or make any financial settlement.
The company said it has since deployed next-generation firewalls, enterprise-grade server protection, endpoint security across its head office and outlets and 24/7 monitoring by cyber security specialists.
Shwapno also said its outlet operations run on a secured offline and intranet-based system, allowing retail services to remain functional during and after the cyber threat.
It maintained that customers’ sensitive financial information remains secure, while urging customers to remain cautious about phishing calls, suspicious messages and fraudulent links.
With more than 40 lakh registered customers and 812 outlets across 63 districts, Shwapno is one of the country’s largest retail chains.
The development has brought renewed focus to data protection and cyber preparedness as digital risks evolve.
