Bukalapak Exposes 13.4 M User Accounts in 2019 Backup Breach
What Happened — In March 2019 the Indonesian e‑commerce platform Bukalapak disclosed that backups taken as early as October 2017 had been accessed by an unauthorized party. The breach released roughly 13.37 million unique records, including email addresses, IP addresses, names, usernames and password hashes (bcrypt and salted SHA‑512).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient backup protection—a scenario continuous control‑assurance programs are built to detect, document, and remediate.
- Highlights the need for immutable, encrypted backup storage and auditable evidence that backup handling complies with data‑protection controls.
- Provides a concrete example of why organizations must map backup‑related safeguards to a single control objective (e.g., “Data Protection – Secure Storage”) that satisfies multiple frameworks.
Who Is Affected — Retail/e‑commerce operators and their customers, particularly those in Southeast Asia.
Recommended Actions
- Verify that all backup repositories are encrypted at rest and enforce strict access controls.
- Implement continuous monitoring and logging of backup creation, modification, and access events to produce defensible audit evidence.
- Map your backup‑security controls to the relevant VCF control objective (Secure Data Storage) and assess coverage across frameworks such as NIST CSF 2.0 or ISO 27001.
Technical Notes — The breach stemmed from exposure of backup files; no public vulnerability (CVE) was disclosed. Passwords were stored as bcrypt and salted SHA‑512 hashes, limiting immediate credential reuse but still representing sensitive credential material. Source: Have I Been Pwned – Bukalapak breach