IndiHome Telecom Breach Exposes 12.6 M Customer Records in Indonesia
What Happened — In mid‑2021 a data set containing 12,629,245 unique IndiHome (indihome.co.id) customer records was posted on a public hacking forum. The dump includes email addresses, full names, IP addresses, gender, and geographic location, with the most recent entries dated November 2019.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce robust access‑control and monitoring over customer data – a core control objective that continuous‑control‑assurance programs are built to verify.
- Demonstrable evidence (e.g., privileged‑access logs, data‑handling policies) is needed to prove that the organization can detect and prevent unauthorized extraction, satisfying the “Protect – Access Control” element of NIST CSF 2.0.
- Mapping this breach to your own control evidence helps create a defensible audit trail and reduces regulatory exposure under privacy statutes.
Who Is Affected – Telecommunications providers (TELCO) and any downstream services that rely on IndiHome’s customer data.
Recommended Actions
- Review and tighten access‑control policies for customer‑information repositories; enforce MFA for privileged accounts.
- Implement continuous logging and real‑time anomaly detection on data‑export activities.
- Collect and archive evidence of access‑control enforcement to support audit readiness (e.g., access‑log reviews, policy attestations).
Technical Notes – The breach appears to be a data‑exfiltration incident; the exact attack vector was not disclosed. Exposed data types: email address, name, IP address, gender, and location. Source: Have I Been Pwned – IndiHome breach