Data Breach Exposes 434,784 Customer Records from Indonesian Watch Retailer Jam Tangan
What Happened — In July 2021 the online Indonesian watch store Jam Tangan (also known as Machtwatch) suffered a data breach that resulted in the public release of 434,784 customer records. The leaked data included email addresses, IP addresses, names, phone numbers, physical addresses, and passwords stored as either unsalted MD5 or bcrypt hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to apply strong, salted hashing for credential storage – a core access‑control objective that continuous‑control programs are designed to monitor and evidence.
- Exposed personally identifiable information (PII) triggers audit‑readiness requirements for data‑handling controls across multiple frameworks (e.g., NIST CSF, ISO 27001).
- Demonstrates the need for ongoing verification that authentication mechanisms meet industry‑accepted security standards, providing defensible evidence for regulators and partners.
Who Is Affected
- Retail e‑commerce (online watch sales)
- Any organization that stores customer credentials without robust hashing
Recommended Actions
- Replace unsalted MD5 hashes with a modern, memory‑hard algorithm (e.g., Argon2) and enforce salting for all password storage.
- Deploy continuous credential‑security monitoring to detect weak hashing practices and generate audit‑ready evidence.
- Review data‑retention policies and encrypt PII at rest to satisfy broader access‑control and privacy controls.
Source: Have I Been Pwned – Jam Tangan breach
Technical Notes
- Attack vector: exploitation of weak password‑hashing implementation (VULNERABILITY_EXPLOIT).
- Data types exposed: email, IP, name, phone, physical address, password hashes (MD5 unsalted, bcrypt).
- Relevant CVEs: none disclosed; the weakness lies in insecure hashing practice rather than a known software flaw.
Source: HIBP breach details