SuaraSurabaya Data Breach: 29,889 Indonesian News Portal Accounts Exposed (2018)

When the News Organization Becomes the Story

SuaraSurabaya -- one of Indonesia's prominent regional news and broadcast portals -- found itself in an uncomfortable posistion in August 2018 when its user database surfaced as part of a coordinated multi-site disclosure. The breach exposed 29,889 accounts with plaintext passwords: no hashing, no salting, no encryption. Just raw credentials sitting in a database waiting for the wrong person to find them.

SuaraSurabaya (August 2018): Breach Summary

• Records Exposed: 29,889
• Data Types: Usernames, email addresses, plaintext passwords
• Breach Type: Database breach
• Password Hash Type: Plaintext (fully compromised)
• Country Affected: Indonesia
• Date Leaked: August 26, 2018

Plaintext Passwords: Zero Days to Crack

There is no security analysis needed for plaintext password storage -- there is nothing to analyze. When passwords are stored in plain text, any attacker with database access has immediate, complete access to every user's credentials. No hashcracking tools, no GPU clusters, no rainbow tables required. The SuaraSurabaya breach gave whoever obtained the database a ready-to-use credential list: 29,889 email-and-password pairs that could be fed directly into automated stuffing tools and tested against email providers, social media platforms, banking apps, and e-commerce sites. Indonesia's growing digital economy means these credentials had real value well beyound the news portal itself.

The Targeting Risk for Media Organization Users

News portal users are a demographically valuable target. Readers and registered users of a regional news outlet tend to be engaged citizens -- people who follow local politics, business, and community affairs. In contexts where press freedom is contested or politically sensitive, a leaked list of news portal subscribers can be valuable beyond credential stuffing. State-linked actors and domestic surveillance operations have used leaked media platform databases to identify journalists, sources, and politically active readers. Whether or not that was the intent behind the SuaraSurabaya disclosure, the risk exists for any user whose identity was confirmed in this database as a regular consumer of Indonesian news content.

August 26, 2018: The Multi-Site Release Pattern

SuaraSurabaya's data was released simultaneously alongside databases from Germany, Japan, Thailand, USA, Russia, and Austria on August 26, 2018. This coordinated cross-continental batch release is consistent with bulk data brokerage operations, where a threat actor aggregates databases from multiple sources and releases them together to establish credibility or move inventory. The diversity of targets -- automotive sites, government portals, fitness platforms, tourism sites, and a news portal -- suggests opportunistic collection rather than targeted industry attacks. Victims across all affected databases faced concurrent exposure with no coordinated warning.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to tell you whether your email address or credentials appear in known breach databases. If you registered on SuaraSurabaya or shared passwords across Indonesian platforms before 2019, check your exposure now.