71 Million Tokopedia User Accounts Exposed in 2020 Data Breach
What Happened — In April 2020 Indonesia’s largest online marketplace, Tokopedia, suffered a data breach. 15 million rows were first posted to a hacking forum, and a further 76 million rows were later supplied to Have I Been Pwned, totaling more than 71 million unique email addresses together with names, genders, birth dates and passwords stored as SHA‑2‑384 hashes.
Why It Matters for Trust & Control Assurance
- The incident shows how a lapse in credential‑storage controls can lead to massive personal‑data exposure, a scenario continuous control‑assurance programs are built to detect and remediate.
- Ongoing evidence collection (e.g., hashing algorithm audits, access‑log monitoring) provides a defensible audit trail for frameworks that require strong identity protection.
- Demonstrable oversight of password policies and MFA adoption is a key control that reassures regulators and partners alike.
Who Is Affected — Retail‑e‑commerce platforms, online marketplaces, and the millions of Indonesian consumers whose personal data were compromised.
Recommended Actions
- Verify that password hashing uses salted, computationally‑hard algorithms; re‑hash any weak or unsalted hashes.
- Deploy mandatory multi‑factor authentication for all user accounts.
- Conduct a forensic review to identify the breach vector, update incident‑response playbooks, and log all remediation steps as audit evidence.
- Integrate continuous credential‑storage monitoring into your control‑assurance platform. Source: HIBP breach report
Technical Notes — The exact attack vector was not disclosed; the breach involved the exfiltration of a database containing SHA‑2‑384 password hashes. No specific CVE is associated. Source: HIBP breach report