Bhinneka bhinneka.com Bhinneka data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Bhinneka, an Indonesian electronics retailer, had almost 1.3 million customer records exposed in early 2020. The data included names, emails, phone numbers, addresses, dates of birth and salted password hashes.
View all 13,118 breaches- Breach date
- 27 Jan 2020
- Affected
- 1,274,340
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Bhinneka, the Indonesian consumer electronics website, suffered a data breach in early 2020. Have I Been Pwned (HIBP) counts 1,274,340 accounts, which it describes as almost 1.3 million customer records.
The breach became public in May 2020. The Jakarta Post reported on 13 May 2020 that the data of up to 1.2 million Bhinneka.com users was reportedly being sold by a hacker group called ShinyHunters at a price of 1,200 US dollars, the same group blamed for breaches at Tokopedia and Bukalapak that month. Bhinneka said it was investigating its systems with Indonesia's National Cyber and Encryption Agency (BSSN).
What was exposed
HIBP lists dates of birth, email addresses, genders, names, passwords, phone numbers and physical addresses. The passwords were stored as salted hashes, which makes them harder to crack than plain hashes but not impossible when the password is weak.
What that lets criminals do
Name, phone number, home address and date of birth in one record is what scammers use to impersonate a shop or a delivery company. Expect messages that mention an order, a refund or a failed delivery. The email and password pair is also useful for credential stuffing, where criminals try the same login on other sites.
What to do now
Change your Bhinneka password and any account that shares it. Turn on two-factor authentication where it's offered. Be sceptical of unexpected texts or emails about orders, and contact the retailer through its official website instead of the message.
Sources checked: haveibeenpwned.com, thejakartapost.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Change your Bhinneka password and any reused one
Use a long, unique password for each account, ideally from a password manager. See CISA on strong passwords and FTC guidance.
- 2
Turn on two-factor authentication
This stops a stolen password from being enough on its own. See CISA's guide to MFA.
- 3
Watch for order and delivery scams
Your phone number, address and name were exposed, so messages about orders or failed deliveries can look real. Don't click links in them. See the FTC on how to recognize phishing.
- 4
Check whether your email or phone is in this and other breaches
Serus runs a free scan of your email and phone number against breach databases and the dark web. If something turns up, it alerts you and tells you what to do next. Serus can't remove data that has already leaked, but it can tell you which of your accounts are exposed. Run a free scan.
Frequently asked
Was I affected by the Bhinneka data breach?
If you had a Bhinneka account around early 2020, you may be among the 1,274,340 accounts HIBP lists. Search your email on HIBP or run a free Serus scan.
What data was exposed in the Bhinneka breach?
Dates of birth, email addresses, genders, names, phone numbers, physical addresses and salted password hashes, according to HIBP.
Who was behind the Bhinneka breach?
The Jakarta Post reported that a group called ShinyHunters was blamed. Bhinneka said it was investigating with Indonesia's cyber agency, BSSN.
Should I change my password?
Yes, on Bhinneka and anywhere you reused it. Then turn on two-factor authentication where you can.
Sources
- Have I Been Pwned: Bhinneka
- Have I Been Pwned: Bhinneka Data Breach · haveibeenpwned.com
- thejakartapost.com/news/2020/05/13/e-commerce-platform-bhinneka-com-reported-to-be-latest-target-of-data-theft.html
- How To Recognize and Avoid Phishing Scams · consumer.ftc.gov
- consumer.ftc.gov/articles/how-keep-your-personal-information-secure
- Use Strong Passwords · cisa.gov
- Turn On MFA | CISA · cisa.gov
Something wrong or out of date? Tell us and we'll re-check it.
