Tokopedia is an Indonesian technology company specializing in e-commerce, it currently operates Indonesia’s largest online store.
The company has over 4200 employees and accounts for over 90 million active users every month.
The hacker claims to have hacked the company in March 2020, it has stolen just a small part of the company database.
The hacker has shared 15 million user records calling for action in cracking the passwords that are hashed using the SHA2-384 hashing algorithm. The seller pointed out that the database didn’t contain the salt strings used by the hashing function, this means that cracking the passwords would be a more difficult.
Experts from data breach monitoring firm Under the Breach @underthebreach has shared some screenshots of the stolen data available for sale:
The researchers at the Cyble Research Team reported that the hackers are holding personal and login details of over 91 million users and are offering them on the darkweb market for sale for 4000 USD.
This is the adv published by the hacker on the Empire Darkweb Market.
According to ZDnet, the dump is a PostgreSQL database containing user information, including full names, emails, phone numbers, hashed passwords, dates of birth, and Tokopedia e-commerce profile details (account creation date, last login, email activation codes, password reset codes, location details, messenger IDs, hobbies, education, about-me fields, and lots more).
ZDNet confirmed the authenticity of the leaked data.
Tokopedia is currently investigating the security breach, it notified the users asking them to reset their account passwords.
Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS
https://docs.google.com/forms/d/e/1FAIpQLSe8AkYMfAAwJ4JZzYRm8GfsJCDON8q83C9_wu5u10sNAt_CcA/viewform
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Tokopedia, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Security Affairs Malware newsletter includes a collection of the best articles and research on malware…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best…
Fintech firm Figure confirmed a data breach after hackers used social engineering to trick an…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in BeyondTrust RS and…
A new alleged Russia-linked APT group targeted Ukrainian defense, government, and energy groups, with CANFAIL…
A new threat actor, UAT-9921, uses the modular VoidLink framework to target technology and financial…
This website uses cookies.