Tokopedia is an Indonesian technology company specializing in e-commerce, it currently operates Indonesia’s largest online store.
The company has over 4200 employees and accounts for over 90 million active users every month.
The hacker claims to have hacked the company in March 2020, it has stolen just a small part of the company database.
The hacker has shared 15 million user records calling for action in cracking the passwords that are hashed using the SHA2-384 hashing algorithm. The seller pointed out that the database didn’t contain the salt strings used by the hashing function, this means that cracking the passwords would be a more difficult.
Experts from data breach monitoring firm Under the Breach @underthebreach has shared some screenshots of the stolen data available for sale:
This is the adv published by the hacker on the Empire Darkweb Market.
According to ZDnet, the dump is a PostgreSQL database containing user information, including full names, emails, phone numbers, hashed passwords, dates of birth, and Tokopedia e-commerce profile details (account creation date, last login, email activation codes, password reset codes, location details, messenger IDs, hobbies, education, about-me fields, and lots more).
ZDNet confirmed the authenticity of the leaked data.
Tokopedia is currently investigating the security breach, it notified the users asking them to reset their account passwords.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
(SecurityAffairs – Tokopedia, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.