If You Used Ptrans, Your Data May Be in an 81,446-Record Breach

In November 2024, HEROIC analysts identified a data breach affecting Ptrans, an Indonesian shuttle bus operator. The compromised database contained records for nearly 114,000 accounts, with 81,446 unique phone numbers confirmed in the exposed dataset. The stolen information was later posted on a Telegram channel, making it immediately accessible to anyone monitoring those networks.

Why the Ptrans Breach Is Dangerous

This breach combined phone numbers, full names, email addresses, and password hashes in a single dataset, giving attackers everything they need to impersonate affected users. Phone numbers enable SIM-swapping attacks, where criminals convince mobile carriers to transfer a victim's number to a new device, bypassing two-factor authentication on banking and email accounts. The mix of bcrypt and MD5 hashing methods in this breach also suggests some passwords are significantly easier to crack than others.

What Was Exposed in the Ptrans Leak

• Phone numbers
• Email addresses
• First and last names
• Password hashes (bcrypt and MD5 with salt)

Why This Ptrans Data Puts You at Risk

Phone numbers combined with full names and email addresses form a complete profile for targeted phishing and social engineering. Attackers can craft convincing messages that reference your real name and contact details, making it harder to identify them as fraudelent. If any of the MD5 hashes in this dataset correspond to common or short passwords, those credentials can be cracked quickly and tested against other services where you may have reused the same login.

How a Database Breach Works

The Ptrans breach appears to have involved direct access to the company's database systems, where an attacker extracted user records in bulk. The data was then distributed via Telegram, a platform increasingly used for sharing stolen data due to its large channel capacities and ease of access. Database breaches of this type often occur through exploited vulnerabilities, weak credentials on administrative accounts, or misconfigured access controls.

Check If Your Data Was Exposed

HEROIC operates one of the world's largest breach databases, covering more than 400 billion leaked records. Use HEROIC's free breach scanner to check if your email address or phone number appeared in the Ptrans leak or thousands of other breaches in our database.