A vulnerability in an online platform created by the Election Commission of Bangladesh before the 13th national parliamentary election has exposed the personal details of over 14,000 journalists, including photos, signatures, and national ID particulars. This breach lasted approximately two hours before the portal was shut down.
The Election Commission had recently implemented new protocols for issuing accreditation cards and vehicle stickers to journalists and observers in preparation for the upcoming election and referendum. Journalists were instructed to submit online applications via a specific portal at pr.ecs.gov.bd to acquire the necessary credentials.
Following objections from journalists, the commission reversed its decision on Thursday, opting to issue cards manually. Nevertheless, prior to this reversal, around 14,000 journalists had already applied through the online system.
These applications contained sensitive data such as images, signatures, copies of national identity documents, office ID cards, and media outlet-related records like lists of approved journalists from news organizations. By Saturday, post 4 PM, this information was publicly accessible on the website. Changing the website address from “user” to “admin” enabled searches that unveiled complete application files and attached documents.
The website’s front page exhibited a roster of applicants featuring names, national ID numbers, and phone numbers, with an option to view full applications. It remains uncertain if individuals accessed or downloaded the information during the time it was exposed.
