Tokopedia, Indonesia's largest e-commerce marketplace, suffered a data breach in April 2020 that exposed the personal information of over 71 million users. The breach pathway was direct, meaning attackers accessed Tokopedia's systems without an intermediary. The method of intrusion has not been publicly disclosed. An initial tranche of 15 million rows of user data appeared on a hacking forum shortly after the breach. A further 76 million rows were later submitted to the breach notification service Have I Been Pwned in July 2020. The exposed data included full names, email addresses, genders, dates of birth, and passwords. The passwords were stored as SHA2-384 hashes, a cryptographic format stronger than older methods but still potentially reversible with sufficient computing power. The combination of personal identifiers and hashed credentials puts affected users at risk of targeted phishing attacks, account takeover attempts, and identity exploitation, particularly if they reused the same password across other services. Tokopedia acknowledged the breach and required users to reset their passwords. Indonesia's Ministry of Communication and Information Technology launched an investigation. At the time, Indonesia had no comprehensive data protection law, limiting the regulatory response available. No major enforcement action or settlement specific to this breach has been documented. Indonesia subsequently enacted its Personal Data Protection Law in 2022. Affected individuals should treat their Tokopedia credentials as compromised, update passwords on any accounts where they reused the same one, and remain alert to unsolicited contact using their personal details.

E-commerce platforms collect customer identity data, emails, passwords, purchase history, addresses, and payment-related information.

Tokopedia has operated within the GoTo Group since the 2021 merger that combined it with ride-hailing and digital payments platform Gojek. GoTo Group listed on the Indonesia Stock Exchange in 2022. The combined entity has navigated significant profitability pressure and has undertaken cost reduction measures. Tokopedia merged with TikTok Shop Indonesia in late 2023, creating a major social commerce platform under GoTo and TikTok's joint venture.