Bukalapak Data Breach (2017): What Was Exposed & What To Do

Bukalapak, an Indonesian e-commerce platform, was subject to a data breach that affected approximately 13.4 million user accounts. The incident involved backups dating to October 2017 and was discovered by the organisation in March 2019. Public records list the exposed information as email addresses, IP addresses, names, usernames and passwords stored as bcrypt and salted SHA-512 hashes.

The scale of the event places it among the larger recorded incidents for an Indonesian online marketplace. Because the passwords were held in hashed form, the immediate usability of the data depends on the strength of individual passwords and the computational difficulty of reversing the hashes. No further technical details about the intrusion or subsequent use of the data have been made public.

Breaking down the breach

The breach concerned backups that originated in October 2017. Bukalapak stated that it identified the incident in March 2019. The reported figures indicate roughly 13.4 million unique email addresses were present in the data set, together with the associated names, usernames, IP addresses and hashed passwords. No information has been released about the method of access, the duration of unauthorised activity or whether other systems were involved.

How a breach like this happens

Incidents involving archived backups commonly occur when older data stores are left accessible through misconfigured servers, unpatched software or credentials that were never rotated. Once an attacker obtains access to such archives, they can copy large volumes of information without triggering alerts that might accompany active production systems. The presence of hashed passwords indicates the organisation had applied standard cryptographic protections at the time, yet the hashes themselves remain valuable for offline attempts to recover plaintext passwords.

About Bukalapak

Bukalapak operates as an online marketplace connecting buyers and sellers in Indonesia. Like similar platforms, it collects account credentials, contact details and transaction-related metadata to facilitate purchases and user verification. A compromise of this nature is consequential because the data can be used to target accounts on other services where users have reused credentials, and because the customer base spans a large segment of the domestic digital economy.

What data was at risk

The disclosed data types are email addresses, IP addresses, names, usernames and passwords stored as bcrypt and salted SHA-512 hashes. It is not known whether additional fields such as payment details, order histories or phone numbers were also present in the backups. Organisations of this type routinely hold further information required for commerce and regulatory compliance; the exact scope beyond the listed items remains unconfirmed.

The real-world impact

Individuals whose information appeared in the data set face the possibility that their email addresses and usernames could be used for targeted phishing or that hashed passwords could be tested against other online accounts. IP addresses may assist in linking activity to specific locations or devices. For the organisation, the incident highlights the long-term sensitivity of retained backups and the need for consistent access controls across all stored copies of customer records.

What to do if you're exposed

Users should change passwords on Bukalapak and any other sites where the same credentials may have been used. Enabling multi-factor authentication reduces the value of a leaked password. Monitoring email accounts for unexpected login attempts or password-reset messages provides an early indicator of misuse. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.