The LAPOR! Breach: 98,408 Indonesian Government Passwords Exposed

HEROIC analysts identified a breach affecting LAPOR! (Layanan Aspirasi dan Pengaduan Online Rakyat), the official Indonesian government platform used by citizens to submit public complaints and feedback, with the breach dated August 20, 2024. The breach extracted 98,408 records from a backend database tied to the platform. The compromised data includes email addresses, usernames, bcrypt password hashes, and IP addresses. Because LAPOR! is a government-run citizen service platform, the people affected are residents who trusted a state-operated service with their credentials.

Even with bcrypt hashing applied to the passwords, this breach is not benign. Bcrypt is one of the stronger password hashing algorithms, but it does not make passwords uncrackable. Attackers with enough computing resources and time can crack weak or commonly used passwords through offline brute-force attempts. The IP addresses in the dataset add another layer of risk, as they can reveal where users accessed the platform from and be correlated with other datasets to profile individuals. The usernames and email addresses alone are enough to mount targeted phishing campaigns impersonating Indonesian government services.

What Was Exposed

• Email Address
• Password Hash (bcrypt)
• IP Address
• Username

Why This Matters

The LAPOR! platform handles citizen grievances and feedback directly submitted to Indonesian government institutions. Users who registered on this platform are not random consumers; they are citizens who actively engaged with government services. This context makes the data particularly useful for attackers crafting government-impersonation phishing campaigns. The presence of bcrypt password hashes means affected users should assume their passwords could eventually be cracked, especially if those passwords are short or follow common patterns. Credential stuffing attacks, where the leaked email and password combination is tested across banking, e-commerce, and social media platforms, are a direct follow-on risk. IP address exposure can also reveal behavioral patterns and location data tied to real individuals.

How Database Breaches Work

A database breach occurs when an attacker penetrates an organization's systems and exports records from a structured data store. For government platforms, the attack often begins with a web application vulnerability, a misconfigured server component, or compromised administrative credentials. Once the attacker has query-level access to the database, they can extract records quickly and quietly. Government citizen service platforms often handle high volumes of users but may operate on aging infrastructure or with limited dedicated security staffing, creating windows of vulnerability that attackers can exploit. The LAPOR! breach data format is consistent with a direct database export.

Check If You Are Affected

The LAPOR! Breach: 98,408 credentials exposed. Yours might be one. If you registered on the LAPOR! platform at lapor.go.id, change your password immediately, especially if you used that same password on other services. HEROIC's free breach scanner covers more than 400 billion records and can confirm whether your email address appears in this or any other known breach. Check now before attackers do.