Indonesian Health Platform Link Sehat Breach Leaks 54,027 Patient Records

HEROIC DarkHive identified a breach of Link Sehat, an Indonesian health platform, on 29 November 2024. The database compromise exposed 54,027 user records containing email addresses, phone numbers, first and last names, IP addresses, and bcrypt hashed passwords with their salts.

Why This Health Platform Breach Is Dangerous

Health platform data is uniquely sensitive because an attacker can pair a verified phone number and home IP with the implicit medical context of the service itself. Even with bcrypt protecting the passwords, the remaining fields are enough to fuel phishing that impersonates doctors, clinics, or insurance providers in Bahasa Indonesia.

What Was Exposed in Link Sehat

The 54,027 records include email address, phone number, first name, last name, IP address, salt, and bcrypt password hash. Bcrypt slows down cracking dramatically compared with MD5, but weak user chosen passwords can still fall, so anyone who reused a simple password should treat it as compromised.

Why This Matters

Indonesia has seen a surge in healthcare data leaks over the past two years, and regulators under the PDP Law are increasing enforcement. For affected patients, the risk extends beyond a single login, exposed phone numbers become a springboard for SIM swap fraud against mobile banking apps tied to the same number.

How Database Breaches Happen

Health platform breaches typically begin with an exploited web application flaw, an exposed backup, or stolen admin credentials sold on Telegram. Once attackers export the user table, they package it with other regional leaks and sell the bundle to credential stuffing operators targeting Indonesian fintech and ecommerce.

Check If You Are Affected

HEROIC monitors over 400 billion compromised records across the surface, deep, and dark web. Run a free scan to see whether your email or phone number appears in the Link Sehat leak, then change the password on any service that shared it and turn on app based multi factor authentication.