MyPertamina Service Breach Exposes Nearly 6 Million Indonesian Customer Records
What Happened – In November 2022 the MyPertamina portal operated by Indonesia’s state‑owned oil and gas firm Pertamina suffered a data breach. Approximately 5,970,416 user accounts were compromised, revealing names, email addresses, dates of birth, genders, phone numbers, physical addresses and purchase histories.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to enforce robust data‑protection controls that a continuous control‑assurance program would monitor and evidence.
- Demonstrates the need for documented consent, privacy‑impact assessments, and a defensible DSAR (Data Subject Access Request) process to satisfy audit requirements.
- Highlights the importance of real‑time logging and incident‑response evidence to prove due diligence to regulators and partners.
Who Is Affected – Energy & utilities sector (oil & gas); any organization handling comparable personally identifiable information (PII).
Recommended Actions
- Conduct a privacy‑impact assessment of the MyPertamina data flows and update consent mechanisms.
- Implement a centralized consent‑management solution and ensure DSAR procedures are documented and testable.
- Map the breach to relevant privacy controls (e.g., data‑handling, access‑logging) and collect evidence for audit readiness.
Technical Notes – The breach was disclosed via Have I Been Pwned; the exact attack vector has not been publicly identified. Exposed data includes DOB, email, gender, name, phone, address, and purchase records. Source: https://haveibeenpwned.com/api/v3/breach/MyPertamina