Indonesia's Tokopedia e-commerce platform probes alleged data leak of 91 million users

Tokopedia, Indonesia's largest e-commerce platform, said it was investigating an attempted hack and claims that the details of millions of its users had been leaked online.

"We found that there had been an attempt to steal data from Tokopedia users," a spokesman for the company said in a statement late Saturday (May 2).

"However, Tokopedia ensures that crucial information such as passwords remains successfully protected behind encryption." "At this moment, we continue to investigate further into this matter and there is no additional information that we can share," the statement added.

Data breach monitoring firm Under the Breach published a Twitter post on Saturday showing screenshots from an unnamed individual who claimed he had acquired the personal details of 15 million Tokopedia users during a March 2020 hack on the e-commerce site.

According to the screenshots, which show names, emails and birthdays, the hacker alleges he or she is in possession of a much bigger user database and asks for assistance to "crack" users' passwords.

Under the Breach, which monitors cybercrime, said on Sunday the hacker had updated the post to offer the details of 91 million users for "US$5,000 on the Darknet". The firm shared a screenshot of the hacker's proposed offer posted online.

UPDATE: same actor is now selling the full database with allegedly 91,000,000 records for $5,000 on the Darknet.

This is really bad, make sure you change your passwords for other services in case you are re-using passwords. pic.twitter.com/bGOnAhmQ7e

— Under the Breach ? (@underthebreach) May 2, 2020

Backed by US$2 billion (S$2.8 billion) in funding from investors including SoftBank Group Corp's Vision Fund and Alibaba, Tokopedia, whose founder and CEO William Tanuwijaya is one of the country's most prominent tech entrepreneurs, claims more than 90 million monthly active users.

Tokopedia did not immediately respond to requests for comment on the hacker's new claims. A spokesman for the firm declined to comment on Saturday on the original screenshots.