Identity Theft Risk Rises: Tries Digital Indonesia Breach Hit 1M Users

HEROIC analysts identified a dataset from Tries Digital Indonesia, an Indonesian digital agency offering web and mobile development, augmented reality, and digital marketing services, posted to illicit channels on September 27, 2025. The dataset contains 1,028,120 records, each including an email address, username, first and last name, gender, phone number, birthday, and a bcrypt password hash.

Why This Is Dangerous

This is not just a list of emails and passwords. It is a near-complete personal profile for each of the more than one million people affected: full name, gender, date of birth, phone number, and login credentials all in one place. Even though bcrypt is a strong hashing algorithm that resists most cracking attempts, an attacker does not need the password at all to cause harm. Name, birthday, and phone number alone are enough to impersonate someone, open fraudulent accounts, or run convincing phishing and SIM-swap attempts.

What Was Exposed in the Tries Digital Indonesia Breach

• Email addresses
• Usernames
• First and last names
• Gender
• Phone numbers
• Birthdates
• Bcrypt password hashes

Why This Matters for the Over 1 Million People Affected

Combining a phone number, full name, and birthdate is exactly what identity thieves need to pass identity verification checks at banks, telecom providers, and other services. Layer on a password hash that could eventually be cracked, especially if it protects a weak or reused password, and the risk expands to credential stuffing and account takeover as well. This mix of data makes financial fraud and impersonation far easier than a leak of passwords alone.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers obtained a direct copy of Tries Digital Indonesia's user records, likely through a vulnerability in the company's web infrastructure or an exposed backend system. Once exfiltrated, the full dataset, including names, contact details, and password hashes, was posted to illicit channels where it can be bought, sold, or freely redistributed among threat actors.

Check If You Are Affected

To find out if your email address, phone number, or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.