DU student data leaked to dark web, fraudsters cash in

Scammers are terrorizing University of Dhaka (DU) students and their families with threatening calls - using arrest, hospitalization, or murder claims - while citing accurate personal details to extort money through fear.

Panic is spread by impersonating police, SRB, or doctors. In some cases, artificial intelligence (AI) is used to clone a relative’s voice and play sounds of crying, immediately followed by pressure to quickly send money via online banking.

An investigation by Agamir Somoy revealed details of such experiences happening to at least 30 families of DU. Although some escaped by doing immediate verification, many fell into the fraudsters’ trap and lost money.

However, the real fear lies elsewhere: criminals already know the personal details of the victims beforehand. Questions have arisen regarding how such personal data of students reached the hands of fraudsters, and whether the security system of the university’s database is merely on paper.

The phone call received by DU student Masuma Jasmine Swarna began over a monetary transaction. The caller claimed her father would send Tk 25,000, from which she had to forward Tk 10,000 to a specific number. Growing suspicious, Swarna wanted to speak with her father.

Within moments, the voice on the other end sounded identical to her father’s voice. Swarna shared that she was somewhat taken aback upon hearing the voice because it sounded exactly like her father, but she realized there was something fishy about the situation and caught the scam.

At the same time, the gang staged another drama by calling Swarna’s father. They demanded Tk 25,000 by instilling fear that her daughter was held hostage, and later, impersonating a SRB member, threatened to dump her corpse. Since father and daughter managed to contact each other quickly, they were able to break out of the trap.

However, the family of Al Mehraj Shahriar Mithun, a resident student of Shahid Sergeant Zahurul Huq Hall from the 2020-21 academic session, fell into the trap. The syndicate first gained credibility with Mithun’s mother by providing accurate information about her son’s name and location. Then, posing as DB Police, they informed her that her son was arrested and that if money was not paid, a “crossfire” awaited him!

Before the conversation even ended, an AI-generated voice wept in Mithun’s cloned voice, saying, “Mother, save me!” Terrified of losing her child, Mithun’s mother was overwhelmed with panic. Seizing the opportunity, the fraudsters pressured her to hand over Tk 40,000 without allowing her to hang up the call.

After the mother sent the money from a shop, they demanded an additional Tk 2,000. Only after pocketing a total of Tk 42,000 did, they disconnect the line. Later, after speaking with her son, Mithun’s mother learned the truth, but by then, the money was already gone.

The scammers carry around not just general names and numbers, but also detailed specifics like which hall the student resides in and which department they study in. The experience of the family of a Department of Bangla student named Alamin follows the same pattern.

An individual identifying himself as a Shahbagh Police Station officer called his home, saying not only his name and address but also which hall he resides in and which department he studies in. Money was then demanded under threat of arrest in a narcotics case. Hearing crying on the other end, his father assumed his son was being beaten.

However, thanks to timely communication via Alamin’s brother, the family escaped losing a large sum of money.

Another example of disorienting relatives with news of an accident involves Ankita Mohanta Anka, a student of Chinese Language and Culture from the 2022-23 academic session. Her mother in Joypurhat received a call claiming her daughter had met with an accident and was admitted to Dhaka Medical College Hospital, urging her to come to Dhaka immediately.

Following this, an AI-cloned voice of Ankita was played, crying, “Save me, I am dying”. However, her mother eventually confirmed Ankita’s well-being through other relatives.

A claim made by Ankita puts the whole affair in the dock. Her mother’s phone number had been provided solely on the university admission documents and nowhere else, and not even a bKash account had been opened with that number.

Ankita suspects that fraudsters not only got hold of the database information, but they also possessed solid intelligence on whether she was in Dhaka at that time.

An investigation reveals that this syndicate primarily traps victims in four steps: building trust by saying the exact names and identities of the student and relative; creating an environment of fear using fake identities of police, DB, SRB, or doctors; heightening panic to its peak by cloning the relative’s voice using AI; and grabbing money while keeping the phone line active so relatives get no opportunity to verify the truth.

When asked about the state of student data security and its exploitation for fraud, the DU administration adopted a tone of avoiding responsibility.

The university’s Pro-Vice-Chancellor (Administration) Mohammed Almujaddade Alfasane told Agamir Somoy, “The matter of student information being leaked was not known to us. However, this cannot be accepted under any circumstances. We will look into the matter with seriousness.”

Investigative findings reveal that the personal data of 77 DU students is on the dark web, with their information under the control of hackers. The passwords and usernames of student email addresses on the university’s admission-related website (eco.du.ac.bd) have fallen into the hands of hackers.

Cybercrime expert Arif Moinuddin told Agamir Somoy, “Through my analysis, I have seen that students’ personal data is primarily reaching hackers directly from the university website. A data breach has occurred. Hackers possessing students’ usernames and passwords means all their personal data has been leaked. This information is now on the dark web. Utilizing this data, fraudsters often hold parents of students hostage in a way to extort money.”

Regarding voice cloning, he explained that it is not an exact replica of a person’s real voice; rather, a voice is generated using AI and stored, after which scammers play this voice to the target individual to accomplish their objective.

The university’s Munshi Shams Uddin Ahmed said when students enroll at the university, they provide their own information along with their parents’ personal details - such as phone numbers and home addresses - on eco.du.ac.bd. All their admission procedures are completed on this website.

He added that the information is recorded on a document designated as the Student Information Form (SIF). This form is initially sent to the student’s chosen department or institute. Following the signature of the department or institute head, it is forwarded once allocated to the hall. After receiving the hall provost’s signature, it is sent back to the department and then forwarded to the respective Dean’s office.

Right after the Dean signs it, the SIF form moves to the Education-2 Section of the Administrative Building. Essentially, the university administration stores the personal details of students and their parents on the admission website and in the Education-2 Section of the Administrative Building.

The Dean of the Faculty of Arts Abul Kalam Sarkar, said, “After the SIF form reaches us, I sign it. The form stays at the Dean’s office for a maximum of two to three days. Then it is sent to the Administrative Building.”

Speaking with several department chairpersons and hall provosts of the university, they said this form is not retained anywhere in the halls or departments. Upon receiving the signatures of the chairman and hall provost, the form is dispatched to the Dean’s office, after which it goes to the Administrative Building.

In the Education-2 Section of the Administrative Building, SIF forms are preserved under several officials. Assistant Registrar Borhan Uddin is in charge of SIF forms for departments and institutes under the Faculties of Arts and Social Sciences, while Maherun Khanam oversees the departments under the Faculty of Science. They added that no student’s information is disclosed to anyone without permission from the Registrar.

Meanwhile, the Convener of the University Online Admission Committee Md Shariful Islam, completely denied any data leak from the website. He said, “Our website has never been hacked. I assure that there is no scope for information to be leaked from here. If it got leaked from somewhere else, that could be the case.”

Supreme Court lawyer Ishrat Hasan told Agamir Somoy, “If personal information of students and parents is leaked and used to collect money, there is scope to take legal action regarding both the criminals’ offense and the negligence of the data-custodian authority.

“Victims can apply to file a case at the police station with call numbers, messages, recordings, and proof of transactions. If a data leak and negligence on the part of the university are proven, action can be sought against the responsible individuals.”