What Happened
In April 2020, Indonesia’s largest e-commerce platform Tokopedia suffered a major data breach that exposed approximately 71-91 million user records. The breach, which occurred on March 20, 2020, initially resulted in 15 million records being posted to a hacking forum, but hackers later claimed to have stolen a much larger dataset of 91 million accounts, which they sold on the dark web for as little as $5,000. The exposed data included email addresses, names, dates of birth, genders, and password hashes (stored as SHA2-384 encryption), along with some mobile phone numbers. While Tokopedia initially claimed that passwords remained encrypted and secure, threat actors subsequently began cracking and sharing dehashed passwords on hacking forums. The company acknowledged the breach in early May 2020 and advised users to change their passwords and implement additional security measures like one-time passwords (OTP).
