Tokopedia data breach: 71.4M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2020-05-02
In April 2020, Indonesia's largest online store Tokopedia suffered a data breach. The incident resulted in 15M rows of data being posted to a popular hacking forum. An additional 76M rows were later provided to HIBP in July 2020. In total, the data included over 71M unique email addresses alongside names, genders, birth dates and passwords stored as SHA2-384 hashes. Exposed data: dates of birth, email addresses, genders, names, passwords. The breach dates from Apr 17, 2020; Have I Been Pwned loaded it on May 2, 2020.
What to do
- If you had a Tokopedia account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
