An Alleged Leak of 5.7 Million Customer Records in Indonesia: Lessons for Small Businesses
Indonesia's digital ministry is examining an alleged leak from a retail customer app involving at least 5.7 million accounts. The case is open, but three lessons already apply to any small business that keeps buyer data.On 4 November 2026 Indonesia's Ministry of Communication and Digital Affairs, known as Komdigi, said it was examining a report of an alleged data leak from the customer app of PT Fore Kopi Indonesia Tbk, the listed company behind the Fore Coffee chain. According to Katadata's report of 5 November 2026, the company's preliminary investigation points to at least 5.7 million affected accounts, and Fore itself reported the matter to the ministry on 28 October 2026.
The case is still under examination. No cause has been announced and nobody has been found at fault, and this article will not guess. The useful question for an owner is a different one: if it were your business tomorrow, what data would walk out, who on your team could open it, and what would you tell your customers?
What has been reported so far
Every point below comes from Katadata's report dated 5 November 2026.
- Fore reported a suspected personal data protection failure to Komdigi on 28 October 2026. The company says it stopped the unauthorised access and secured its systems within 24 hours.
- The affected data varies by customer: name, email, phone number, date of birth, gender, addresses saved in the app, hashed PINs, and purchase history.
- Fore says the app never asked for or stored the national identity number (NIK) or identity card photos. Credit and debit card data sits on a separate platform and was not affected.
- Fore asked customers to change their PIN, introduced two-factor authentication for logins from new devices, and warned customers to be careful with calls, SMS, emails or WhatsApp messages claiming to come from Fore.
- In a written statement on 4 November 2026, Komdigi's Muchtarul Huda said no party had been declared responsible. If negligence is proven, administrative action or sanctions may follow under the Personal Data Protection Law and the government regulation on electronic systems and transactions.
For context, Databoks Katadata on 3 August 2026 cited Surfshark: 1.22 million accounts in Indonesia were affected by data breaches in the first half of 2026, the highest of 11 Southeast Asian countries studied. We quote that from the Databoks summary page and did not read the detail behind it.
Why this concerns small firms too
Small businesses rarely run their own app, yet nearly all of them hold buyer data: WhatsApp numbers on a staff phone, delivery addresses in a spreadsheet, a member list in a notebook or a point-of-sale app, order history in chat. The data named in the Fore report, meaning names, phone numbers, addresses and purchase history, is exactly what any order-taking business keeps. That is what makes an alleged customer data breach Indonesia's regulator is examining relevant to a shop with five staff.
Three things in the report are worth noting.
First, data you never stored cannot leak. Fore says it never asked for identity numbers or card photos and kept card data elsewhere. Whatever the examination concludes, choices like that limit the damage of an incident.
Second, the follow-on harm often comes from impersonators. That is why a warning about calls and messages in the company's name was part of the customer notice.
Third, the clock matters. There is a reporting date, a claim of securing systems within 24 hours, and a regulator's statement. A business that does not know where its data lives cannot move that fast.
Three jobs for this week
This section is our practical advice, not part of the reporting above.
1. Collect less
Open your order form, your membership form and the chat template your staff use. For each field, ask what it is used for.
| Data | Keep it when | Consider dropping it when |
|---|---|---|
| Name and phone number | Used to confirm orders | Almost always needed |
| Full address | You deliver | Customers always collect in person |
| Date of birth | A birthday offer really runs | It is there "just in case" |
| Identity card photo | A clear legal duty requires it | It is "verification" with no basis |
Delete old data you no longer use as well: the promotion spreadsheet from two years ago, contact exports sitting in a downloads folder, chat backups on a former staff member's phone.
2. Tidy up who can open what
- Write down every place customer data lives: staff phones, marketplace accounts, shared spreadsheets, the point-of-sale app, the books.
- Next to each, write the names of people with access. Cross out anyone who has left or changed role, and remove their access the same day.
- Stop sharing one password among everyone. Where the tool allows it, give each person their own login and turn on two-step verification.
- Make sure the phone that holds the business number is locked with a PIN and is not a personal phone passed around.
3. Draft the message before you need it
Notices written in a panic are bad notices. Draft yours now, with four parts:
- What happened and when you learned of it, in plain language.
- Which kinds of data may be affected, and which are not.
- What customers should do, for example change a PIN or password.
- Your genuine channels, plus a sentence saying your business never asks for one-time codes, PINs or transfers to a personal bank account by phone or chat.
The fourth point is worth sending even without an incident. Customers who know your real number are harder to fool when someone pretends to be you.
What cannot be concluded yet
The 5.7 million figure is an "at least" number from the company's own preliminary investigation and may change. The cause has not been announced. Komdigi has not named a responsible party. The lessons above were chosen so they do not depend on the outcome: they hold whatever the examination finds.
If your team serves customers through one WhatsApp number, a shared inbox worked by several staff, with notes per customer, helps keep conversations from scattering across personal phones. Polynusa offers that, and the details are on the pricing page.
Note: legal duties around personal data differ from one business to another. Confirm your own case with a legal consultant or the relevant authority.
Sources
- Katadata, 5 November 2026: Komdigi Periksa Dugaan Kebocoran 5,7 Juta Data Pelanggan Fore
- Databoks Katadata, 3 August 2026: Indonesia Records Highest Data Breaches in Southeast Asia in H1 2026
FAQ
What is known about the alleged Fore Coffee data leak?
According to Katadata, Fore reported a suspected personal data protection failure to Indonesia's digital ministry on 28 October 2026, and its preliminary investigation points to at least 5.7 million affected accounts. The ministry is still examining the case and has named no responsible party.
Which customer data should a small business stop collecting?
Anything not used to serve the customer, such as identity card photos, full birth dates, or home addresses when you never deliver. The less you hold, the less there is to lose in an incident.
What should be ready before a data incident happens?
A list of every place customer data is stored, a list of who has access to each, and a drafted customer notice that says what happened, what customers should do, and which channels are genuinely yours.