Researchers Link the Bank Syariah Indonesia Breach to 383,181 Exposed Customer Records

HEROIC analysts found the Bank Syariah Indonesia breach in August 2023, when a dataset containing 383,181 records was posted to a well-known hacking forum. The compromised data was pulled from Indonesia's largest Islamic bank, and it included the kind of personally identifiable information that makes targeted fraud and social engineering campaigns highly effective. The scale of this leak, over 383,000 banking customers, placed it among the more significant financial sector exposures detected that period.

What Attackers Can Do With Banking Customer PII

Phone numbers, names, and email addresses pulled from a banking database are not just contact details. They are the raw material for SIM-swap fraud, phishing calls posing as the bank's customer service team, and identity verification bypass attempts. Attackers who know you are a Bank Syariah Indonesia customer can craft a highly convincing impersonation. Recieved calls from someone who already knows your name and bank affiliation are far more dangerous than generic scam attempts.

What Was Exposed in the Bank Syariah Indonesia Breach

• Email addresses
• Phone numbers
• First names
• Last names

Why Financial Sector PII Leaks Enable Identity Theft at Scale

When personal data leaks from a bank, the combination of name, phone, and email creates a trifecta that is partcularly dangerous. Threat actors use this data to conduct vishing attacks, send phishing emails with bank branding, and attempt SIM swap attacks to gain access to two-factor authentication codes. Once phone access is captured, attackers can reset passwords on financial accounts and drain them within minutes. Identity theft and financial fraud become highly accessable when the victim's banking relationship is already known.

How Database Breaches at Financial Institutions Work

Banks operate large customer databases that store account holder details for compliance, communication, and transaction processing. When these systems are compromised through SQL injection, insecure API endpoints, or insider access, attackers can export entire tables of customer records. The data then occured as listings on hacking forums, either sold to the highest bidder or posted freely to establish the threat actor's reputation. In the Bank Syariah Indonesia case, the forum post made the data accessable to a broad range of criminal actors simultaneously.

Check If Your Data Was Exposed

If you are or were a Bank Syariah Indonesia customer, your contact information may have already been circulating in criminal networks for over a year. Run a free scan with HEROIC's breach scanner, which covers 400 billion-plus compromised records, to find out what data tied to your email address has been exposed.