Cyber Incident Victim: IndiHome
Date:
Aug 2022
Location:
Indonesia
Summary
A significant data breach impacted IndiHome, a telecommunications service provider, compromising personal information of over 26 million subscribers. The leaked data included sensitive browsing history details such as dates, passwords, domains, platforms, browsers, and specific URL links accessed by users. Indonesia's Communication and Informatics Ministry confirmed it was investigating the incident and planned to formally engage the parent company, PT Telkom Indonesia, for clarification regarding the unauthorized disclosure. The exposed subscriber information reportedly appeared on illicit websites, prompting governmental scrutiny of the security incident affecting internet service customers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around August 21, 2022, Indonesia’s Communication and Informatics Ministry confirmed it was investigating reports of a significant data breach impacting IndiHome, an internet service operated by state-owned telecommunications provider PT Telkom Indonesia. The ministry announced it would summon Telkom’s management to clarify details surrounding the alleged leak of subscriber data, which reportedly included sensitive browsing histories and authentication credentials. Initial reports indicated that personal information from 26,730,798 IndiHome subscribers had been compromised and uploaded to illicit websites. The exposed data encompassed detailed internet usage records, including dates of access, user passwords, visited domains, platform types, browser information, and specific URL links. No further technical details regarding the breach mechanism, intrusion timeline, or attacker attribution were disclosed by authorities at this preliminary stage.
The incident represented one of Indonesia’s largest known consumer data exposures, with particularly severe implications due to the inclusion of passwords and comprehensive web activity logs. The leaked browsing histories could potentially reveal subscribers’ private online behavior, while compromised credentials heightened risks of account hijacking and secondary attacks. Telkom had not issued a public statement addressing the breach at the time of the ministry’s announcement. Government officials emphasized the urgency of their investigation but did not describe specific containment measures, remediation steps, or notifications to affected customers. The breach’s discovery coincided with Indonesia’s broader efforts to enforce its updated personal data protection regulations, though no immediate legal or financial consequences for Telkom were detailed in the initial report.