Kreditplus Data Breach (2020): What Was Exposed & What To Do

In June 2020, the Indonesian credit service Kreditplus suffered a data breach that exposed 896,000 records containing 769,000 unique email addresses. The incident was reported on 23 June 2020, and the data was later supplied to Have I Been Pwned by breachbase.pw. The records included extensive personal details such as names, family information, employment data, income and expense figures, and religious affiliation. The breach matters because Kreditplus holds financial and household information that can be used for targeted fraud or identity misuse. No further technical details about the intrusion have been made public.

Inside the incident

Public records state that 896,000 records were obtained, corresponding to 769,000 distinct email addresses. The exposed fields listed in available reports include dates of birth, email addresses, employers, family structure, genders, income levels, living costs and marital statuses. Additional fields mentioned in the same reports cover names, information on spouses, income and expenses, religions and employment information. The exact method of access, the date of the intrusion itself, and any subsequent actions by the organisation remain undisclosed.

How a breach like this happens

Incidents involving large volumes of customer records from financial service providers often begin with unauthorised access to internal databases or third-party systems that store user data. Attackers may exploit weak authentication controls, unpatched software, or compromised credentials to reach files containing personal and financial details. Once obtained, the data can be packaged and distributed through forums or data-sharing platforms. In many cases the initial compromise occurs weeks or months before the material appears publicly.

About Kreditplus

Kreditplus operates in the consumer finance sector in Indonesia, offering credit products that require applicants to supply personal identifiers, household composition, employment history and income documentation. Organisations of this type routinely collect and retain data that links individuals to their financial circumstances and family relationships. A breach at such a firm therefore involves records that are both sensitive and difficult to change once exposed.

What was likely exposed

The available reports identify the following categories of information among the exposed records:

• Dates of birth
• Email addresses
• Employers
• Family structure
• Genders
• Income levels
• Living costs
• Marital statuses
• Names
• Information on spouses
• Income and expenses
• Religions
• Employment information

Whether every record contained all listed fields, or whether additional categories were present, has not been confirmed.

The real-world impact

Individuals whose records appear in the dataset face an elevated risk of receiving phishing messages that reference their actual financial or family details, increasing the chance that recipients will treat the messages as legitimate. The combination of income, employment and household data can also support more convincing attempts at account takeover or fraudulent loan applications. For the organisation, the incident creates regulatory and reputational consequences typical of any large-scale exposure of customer financial records.

Were you affected?

Anyone who has applied for credit through Kreditplus or supplied an email address to the service should treat their inbox as potentially known to third parties. Practical first steps include monitoring bank and credit accounts for unusual activity, enabling multi-factor authentication on any linked services, and reviewing privacy settings on email accounts. Readers can also run a free exposure scan of their email address against known breach data to check whether their information has appeared in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.