Bukalapak 2017 Data Breach
ObscureIQ Breach Intelligence
Low SeverityWebsite / service breach
Bukalapak Indonesian E-Commerce Marketplace Breach (2017): 13 Million User Accounts Including Passwords Exposed
Indonesian e-commerce marketplace.
Verified by ObscureIQ Intelligence
23/100Breach Risk Index
5Data Value
25Market Recency
519dSince Breach
Breach Intelligence Summary
Entity: Bukalapak · Actor: Gnosticplayers · Sources: 6 references
Attack: Unknown
Profile: Platform · E-commerce marketplace · Consumer goods marketplace · Indonesia
Timeline: Breach (2017-10-23) · Indexed (Feb 04, 2025) · Year (2017)
Exposure: 13.0M records · 5 fields: Email Address, Full Name, IP Address, Password, Username
Status: Confirmed
Executive Summary
In October 2017, Indonesian e-commerce marketplace Bukalapak suffered a breach (identified in March 2019 via its backups) exposing approximately 13 million user records including email addresses, usernames, names, IP addresses, and passwords stored as bcrypt and salted SHA-512 hashes. The data was sold on the dark web by the actor "Gnosticplayers" as part of a multi-site batch. Bukalapak publicly downplayed the incident, though passwords were confirmed exposed. (Note: this is an Indonesian / Southeast Asian breach, not South American as a prior internal note suggested.)
ObscureIQ assessment: Exposure enables phishing, order fraud, seller impersonation, and account abuse. Buyer-seller interaction data also increases marketplace scam risk.
Breach Impact
The exposure of emails, usernames, names, IP addresses, and hashed passwords for ~13 million Indonesian users creates credential-stuffing and account-takeover risk (mitigated by strong hashing) and targeted phishing. As one of the first major Indonesian datasets sold by Gnosticplayers, it fed broader credential-abuse ecosystems.
About Bukalapak
Bukalapak is a major Indonesian e-commerce marketplace (one of the country's tech "unicorns"), connecting buyers and sellers across Indonesia. It maintains user account, contact, and transaction records.
Why They Hold Your Data
E-commerce marketplaces collect customer and seller identity, contact details, addresses, payment-adjacent records, order history, and marketplace communications across commerce systems.
Recent Developments
In March 2019, Bukalapak identified a breach of its backups dating to October 2017. The ~13 million-record dataset was part of a series of databases sold on the dark web by the actor "Gnosticplayers" (fourth batch). Bukalapak downplayed the exposure, but passwords (bcrypt / salted SHA-512) were among the compromised data.
Data Points Exposed
5 verified field types
Email Address
Full Name High
IP Address
Password Critical
Username
Field names are shown in full for clarity and search visibility. Canonical machine keys are emitted only in this page’s structured data.
Exploitation & Downstream Threats
Threat Activity:High
Primary downstream threats:
- Credential stuffing and account takeover against reused passwords (mitigated by strong hashing)
- Targeted phishing using exposed emails and names
- Account enrichment via IP/username linkage
Threat vectors:
- Credential stuffing & account takeover
- Password reuse exploitation
- Phishing & social engineering
- Profile enrichment
Threat Actor: Gnosticplayers
Gnosticplayers
Unknown
Attribution and method are based on available breach intelligence. Reported attack vector: Unknown.
Recommended Actions
If you believe your information may be included:
Change Reused Passwords
Update this account and anywhere you reused the password; use a manager.
Enable MFA Everywhere
Turn on multi-factor authentication on email first, then financial accounts.
Report & Recover
If you spot misuse, start an official recovery plan and report fraud.
Frequently Asked Questions
What happened in the Bukalapak breach?▾
In October 2017, Indonesian e-commerce marketplace Bukalapak suffered a breach (identified in March 2019 via its backups) exposing approximately 13 million user records including email addresses, usernames, names, IP addresses, and passwords stored as bcrypt and salted SHA-512 hashes. The data was…
What data was exposed?▾
Verified fields include Email Address, Full Name, IP Address, Password, Username.
What should I do if I was affected?▾
Change reused passwords, enable MFA, and (if identity or financial data is involved) freeze your credit and monitor your accounts.
Sources & References
Every claim on this page is traceable. This breach draws on:
Breach Index
Breach Index
Cross-source
9ghz
Cross-source
BreachForums_Official_Index
Cross-source
leakfind
ObscureIQ Intelligence
ObscureIQ proprietary analysis
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation