How a Database Breach Exposed 1,025 LINE Bank Customers

HEROIC analysts documented the LINE Bank breach after a database extract from Indonesia's digital bank (linebank.co.id) surfaced on February 6, 2025. The dataset exposed 1,025 customer records containing email addresses, phone numbers, first names, and last names, the baseline identity set banks use to route communications and verify callers.

Why This Financial Breach Is Dangerous

Even a small banking leak is high-value data. Each record pairs a verified customer email with the phone number on file and the legal name the bank has on record. That trio is precisely what a convincing financial phish or voice scam needs to clear basic identity questions.

What Was Exposed in the LINE Bank Leak

• Email addresses registered to LINE Bank accounts
• Phone numbers linked to the customer profile
• First names and last names as recorded by the bank

Why This Matters

The combination powers targeted phishing that mimics LINE Bank messaging, SIM swap attempts against the registered phone, account takeover attempts using reset flows, and identity theft that stacks the LINE Bank data with other leaks. For a digital-first bank, trust in the app is the product; stolen contact data erodes it fast.

How Database Breaches Work

A database breach usually starts with an SQL injection, an exposed admin API, a leaked staff credential, or a third-party vendor pivot. Attackers extract customer tables directly, then sell or share the dump on Telegram and dark web forums. Smaller record counts often indicate a targeted query rather than a full table dump, meaning the rows are curated and higher quality.

Check If You Are Affected

If you hold a LINE Bank account or any Indonesian FinTech product, check your exposure free against HEROIC's 400 billion plus record scanner. A quick scan reveals whether your email has appeared in this leak or other financial data exposures.