Pierluigi Paganini
May 03, 2020
Tokopedia is an Indonesian technology company specializing in e-commerce, it currently operates Indonesia’s largest online store.
The company has over 4200 employees and accounts for over 90 million active users every month.
The hacker claims to have hacked the company in March 2020, it has stolen just a small part of the company database.
The hacker has shared 15 million user records calling for action in cracking the passwords that are hashed using the SHA2-384 hashing algorithm. The seller pointed out that the database didn’t contain the salt strings used by the hashing function, this means that cracking the passwords would be a more difficult.
Experts from data breach monitoring firm Under the Breach @underthebreach has shared some screenshots of the stolen data available for sale:
The researchers at the Cyble Research Team reported that the hackers are holding personal and login details of over 91 million users and are offering them on the darkweb market for sale for 4000 USD.
This is the adv published by the hacker on the Empire Darkweb Market.
According to ZDnet, the dump is a PostgreSQL database containing user information, including full names, emails, phone numbers, hashed passwords, dates of birth, and Tokopedia e-commerce profile details (account creation date, last login, email activation codes, password reset codes, location details, messenger IDs, hobbies, education, about-me fields, and lots more).
ZDNet confirmed the authenticity of the leaked data.
Tokopedia is currently investigating the security breach, it notified the users asking them to reset their account passwords.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
https://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Tokopedia, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
