Dukcapil Leak Resurfaces Online, Exposing 10.8 Million ID Records

The most dangerous part of this file is not any single field, it is the combination: a national identity number paired with a full name, phone number, and birthdate for more than 10.8 million people. HEROIC analysts found this dataset, tied to Indonesia's Dukcapil civil registry, recirculating on Telegram years after it was first taken. Scan your email to see whether your information is part of it.

Why an ID Number and a Birthdate Together Are Dangerous

Neither detail alone is catastrophic, but together they are close to everything someone needs to impersonate you with a government agency, a bank, or a call center that verifies identity with exactly these questions.

What the Dukcapil Records Contained

• Social Security Numbers: this field covers each person's national identity (NIK) number, a government issued ID used throughout Indonesia.
• First Name and Last Name: ties the ID number to a real identity an attacker can act on.
• Phone Number: enables scam calls and texts that reference real personal details.
• Birthday: a near universal identity verification question an attacker now has the answer to.
• Gender: rounds out the profile of each person in the file.

Why This Still Matters Even Without a Password

No email addresses or passwords were found in this file, so there is nothing to change here. The risk instead is identity based: scam calls, fraudulent applications, and messages that feel legitimate because they quote your own ID number back to you.

How Old Records Keep Resurfacing

This dataset covers residents across East Java, Central Java, Bandung, Bekasi, South Jakarta, Medan, and Yogyakarta. Once a government database like this is copied out, the same file can be repackaged and re-uploaded to new Telegram channels years later, which is exactly what analysts observed happening here.

Is Your Information in the Dukcapil File?

Scan your email to see what was exposed. Since no passwords were involved, the best protection is awareness: treat unexpected calls, texts, or account requests that reference your ID number or birthdate with suspicion, whether they arrive at a personal or a work email address.