ACI Logistics Limited, the company that runs Shwapno, Bangladesh's largest supermarket chain, filed a police complaint about a ransomware attack about seven months after it happened. According to a summary of the police complaint published by cyber.hendryadrian.com, ransomware locked computers at the ACI Logistics head office on 19 August 2025. The attackers demanded US$1.5 million to keep stolen data private and set a 10-day deadline. More than 410 GB of data was later published, including customer, supplier, sales, contract and banking records. Some headlines describe the demand as "5 million", but every report that gives the full figure says $1.5 million. Reports also disagree on when the breach started and which ransomware group was behind it. ACI Logistics has not issued a public statement, and the details of the police complaint have not been independently confirmed.
What Happened
The clearest account comes from the police complaint, known in Bangladesh as a General Diary (GD). cyber.hendryadrian.com summarises it as follows:
- Before August 2025: Shwapno employees received phishing emails containing malicious links.
- 19 August 2025: Ransomware locked computers at the ACI Logistics head office. Shwapno's MIS (IT) team disconnected the affected systems and removed the malware.
- Ransom demand: The Qilin ransomware group demanded $1.5 million to stop sensitive data from being released, with a 10-day deadline.
- Later: More than 410 GB of data was published through a leak site the GD describes as a LockBit 5.0 portal.
- 28 March 2026: Md Masum Billah, head of administration at ACI Logistics, filed the GD. Police say it has been passed to the Detective Branch Cyber Unit.
Other reports tell a different story about the dates. Treeplmn.com quotes Shwapno managing director Sabbir Hasan Nasir as confirming the breach and saying hackers had control of the company's website and database "as early as December last year". Lengsb24.com also says the incident happened in December and that Shwapno took three months to spot it. Carnavalhechoamano.org repeats the August 2025 date and says the company secured its database as soon as it received the hackers' email in August, but did not realise until later that the attackers had kept copies of the data. None of the reports explain how a December intrusion fits with the August date in the GD. One possibility is that there were two separate events, such as an earlier intrusion into the database and a later attack on the head office, but no report says so.
The attacker is also unclear. The GD summary says Qilin made the ransom demand but that the data appeared on a LockBit 5.0 leak site. Qilin and LockBit are separate operations. This could point to an affiliate who works with both groups, data resold or reposted by someone else, or a mistake in the reporting. Neither group's claim has been publicly confirmed, and the attack should not be firmly pinned on either one yet.
On whether the ransom was paid, Lengsb24.com and cripplecreekcabin.com say Shwapno chose not to deal with the attackers. The fact that the data was published fits with that, but the company has not said so itself.
What Was Taken
According to the GD summary, the published data includes:
- Customer names and phone numbers
- Customer purchase histories
- Supplier details and contracts
- Daily sales records
- Bank deposit information
The size of the leak is reported as more than 410 GB. No report gives a confirmed number of affected people. Several sites say Shwapno has more than 40 lakh (4 million) registered customers, but that is the size of its customer base, not a confirmed count of exposed records. Treeplmn.com and Lengsb24.com describe a customer in Dhaka's Gulshan area who found his wife's record, with purchase and transaction history, by searching her phone number in the leaked data. Cripplecreekcabin.com says customer data circulated on social media. Treeplmn.com says Shwapno did not warn customers publicly that their data might be exposed.
The supplier, contract and banking records are probably the most useful to criminals. They make it easier to write convincing invoice-fraud and payment-redirection emails aimed at Shwapno's suppliers and partners.
Why It Matters
The seven-month reporting gap. This is the most important lesson for defenders. Waiting seven months to involve police gives evidence time to disappear and gives attackers time to spread stolen data. During that time customers had no warning that their phone numbers and shopping histories might be used in scams. A delay does not prove negligence, and the company has not explained when or why it decided to file.
Unclear attribution makes response harder. When reports name both Qilin and LockBit 5.0, responders cannot rely on one group's known tools and behaviour. Teams investigating similar cases should check both groups' known indicators.
Retail loyalty data is easy to exploit. A name, phone number and purchase history is enough for convincing SMS and phone scams, especially in a market that relies heavily on mobile payments. In the same period, Credora Fintech pointed to reported breaches at the Bangladeshi ride-hailing and delivery company Pathao as evidence of a wider problem. Pathao's breach is a separate reported incident and has no known link to this one.
The Attack Technique
The GD summary describes a common pattern of phishing followed by encryption and extortion:
- Initial access: Phishing emails with malicious links sent to Shwapno employees (MITRE ATT&CK T1566.002, Spearphishing Link).
- Impact: Head-office computers encrypted with ransomware (T1486, Data Encrypted for Impact).
- Exfiltration and extortion: Data stolen before encryption, followed by a ransom demand with a deadline and publication of the data on a leak site.
Treeplmn.com's report that attackers controlled the website and database suggests the customer database may have been accessed directly, not only the head-office computers. No technical indicators, malware samples or forensic findings have been published. Treeplmn.com says Shwapno is working with forensic experts and police.
What Organizations Should Do
- Treat phishing links as a ransomware entry point. Rewrite and sandbox links in email, require phishing-resistant multi-factor authentication (MFA) for email and remote access, and give staff a one-click way to report suspicious messages.
- Separate customer databases from office networks. A compromised head-office computer should never be able to reach the loyalty or e-commerce database. Restrict database access to named service accounts and alert on bulk exports.
- Watch for data leaving the network, not just encryption. Reaching 410 GB means a lot of outbound traffic. Alert on large or unusual uploads to cloud storage and file-transfer tools, especially outside business hours.
- Assume stolen data is still out there. Removing the malware does not get the data back. Once an extortion email arrives, start breach notification planning and contact law enforcement within days, not months.
- Warn the people at risk. Tell customers to expect scam calls and messages that mention their purchases. Tell suppliers to confirm any change to bank details by phone using a known number.
- Check for both Qilin and LockBit 5.0. If you are investigating a similar intrusion, search for indicators and tools linked to both groups, since reports here name both.
Sources: Shwapno Reports ACI Logistics Ransomware Attack to Police Seven Mon... | Shwapno Files Police Report Over 2025 Ransomware Attack and Data Le... | Shwapno Data Breach: 40 Lakh Customers' Details Exposed! Hackers De... | Rethink Cybersecurity in Bangladesh After Pathao Data ... | Shwapno Data Breach: What Happened and How to Stay Safe (2026) | Shocking Data Breach: Retail Giant Shwapno's Customer Info Leaked (... | List of data breaches | Shwapno Database Hacked: 4 Million Customers at Risk! $1.5M Ransom...