Our Analysts Found the Bukalapak Dump in Private Telegram Channels

HEROIC analysts found the Bukalapak database circulating in private Telegram channels frequented by credential traders and data brokers. The breach occured in October 2017, when attackers accessed backup files belonging to Bukalapak, one of Indonesia's largest e-commerce platforms. Nearly 13 million user records were exposed, including email addresses, IP addresses, first and last names, and password hashes. The dataset had been quietly passed around for years before our team flagged a sharp increase in trading activity targeting Indonesian users.

Why Your Name, Email, and IP Address Together Are Dangerous

When attackers combine your real name, email address, and IP address, they can craft highly convincing phishing messages that look nothing like generic spam. They know who you are, where you live approximately, and what service you used. This makes social engineering attacks far more effective. On top of that, the password hashes in this breach can be run through cracking tools, and weaker passwords are often recieved back as plaintext within hours, giving attackers working login credentials.

What Was Exposed in the Bukalapak Breach

• Email Address
• IP Address
• First Name
• Last Name
• Password Hash

Why 13 Million Records From Indonesia Are a Global Risk

Bukalapak had tens of millions of users across Southeast Asia. With real names and emails in hand, attackers can attempt account takeover on shopping platforms, banking apps, and social media. Credential stuffing tools can automate millions of login attempts per day. Identity theft is a seperate but equally serious risk, as full names paired with email addresses give scammers enough information to impersonate victims or open fraudulent accounts. This data does not lose value over time.

How Database Breaches Work

A database breach happens when an unauthorized party gains access to a company's stored user data. In Bukalapak's case, attackers accessed backup files, which are copies of the main database often stored with less security than the live system. These backups are a common target because they contain all the same sensitive information but may not be monitored as closely. Once copied, the data is sold, shared, or used directly in attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion compromised records, including data from the Bukalapak breach. If your email address was part of this incident, you will see it in your results. Search your email at HEROIC now to find out what information about you is already in the hands of cybercriminals.