Indonesian e-commerce portal probes alleged leak of 91m users' data

JAKARTA • Indonesia's largest e-commerce platform Tokopedia said it was investigating an attempted hack and claims that the details of millions of its users had been leaked online.

"We found there had been an attempt to steal data from Tokopedia users," a company spokesman said in a statement late on Saturday.

"However, Tokopedia ensures that crucial information such as passwords remains successfully protected behind encryption," the statement added.

Data breach monitoring firm Under the Breach published a Twitter post on Saturday which showed screenshots from an unnamed individual who claimed to have acquired the personal details of 15 million Tokopedia users during a hack on the portal in March this year.

The screenshots show names, e-mail addresses and birthdays, and the hacker claimed to be in possession of a much bigger user database and asked for help to "crack" users' passwords.

Under the Breach, which monitors cyber crime, yesterday said the hacker had since updated the post to offer the details of 91 million users for "US$5,000 on the Darknet". The firm shared a screenshot of the hacker's proposed offer posted online.

Backed by US$2 billion (S$2.83 billion) in funding from investors including SoftBank's Vision Fund and Alibaba, Tokopedia claims to have more than 90 million monthly active users. The site's founder and chief executive William Tanuwijaya is one of Indonesia's most prominent tech entrepreneurs.

Tokopedia did not respond to requests for comment.

A Tokopedia spokesman declined to comment directly on the hacker's claims, but told Reuters yesterday that "all transactions with all payment methods at Tokopedia ... remain secure".

REUTERS