RAB busts ring that hacked BRTA server, embezzled Tk1.2cr

The Rapid Action Battalion has busted a ring that hacked into the server of firm Computer Network Systems affiliated with the Bangladesh Road Transport Authority and scammed Tk1.20 crore through fake money receipts.

The ring had earlier hacked the website of the Dhaka Electric Supply Company Limited in November-December 2022 and scammed around Tk1.50 crore by faking money transaction account.

Six members of the ring, including ringleader computer engineer Sharear Islam, were arrested on Sunday from Kafrul, Mirpur of Dhaka and Gazipur Sadar.

The other arrestees are Azim Hossain, Shimul Bhuiyan, Rubel Mahmud, Foysal Ahmed and Anisur Rahman.

Briefing the media Monday, RAB's media wing director Khandaker Al Moin said Computer Network Systems Limited has been conducting all transactions related to motor vehicle taxes, licence renewal and ownership changing for over 10 years.

The firm noticed anomalies in transaction amounts recently and complained to RAB. During investigation, RAB found that their server security was compromised and hacked.

The ring had breached into the firm's server and used 389 fake money receipts to embezzle Tk1.2 crore, said the RAB officer.

Shahrear had faked money receipts by breaching into the server. Later, he used the receipts to take money for motor vehicle related transactions, even though the money was never deposited to Computer Network Systems's account.

A CPU, mobile phone, SIM card, pen drive, cheque books of various banks, and other equipment used in fraud and Tk1,89,659 were seized from their possession. 

Moin said the money embezzlement was done between 12 April and 10 May 2023.

The RAB officer said the ring used to take money from people through brokers at Mayer Doa Business Centre and Chandpur Business Centre in Mirpur and then give them forged payment token they collected after hacking server.

Earlier in late 2022, the ring hacked Desco website and scammed around Tk1.50 crore by faking as a money transaction account.

Desco later identified the breach into their website and fixed it, but the authorities could not find the ring, said RAB officials.