Bukalapak 2017 Data Breach
Platform · E-commerce marketplace · Consumer goods marketplace · Indonesia
Bukalapak Indonesian E-Commerce Marketplace Breach (2017): 13 Million User Accounts Including Passwords Exposed
Indonesian e-commerce marketplace.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
23/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
13.0MRecords
2017Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
In October 2017, Indonesian e-commerce marketplace Bukalapak suffered a breach (identified in March 2019 via its backups) exposing approximately 13 million user records including email addresses, usernames, names, IP addresses, and passwords stored as bcrypt and salted SHA-512 hashes. The data was sold on the dark web by the actor "Gnosticplayers" as part of a multi-site batch. Bukalapak publicly downplayed the incident, though passwords were confirmed exposed. (Note: this is an Indonesian / Southeast Asian breach, not South American as a prior internal note suggested.)
Full threat analysis, exploitation vectors, and principal guidance below.
12 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
13.0M records analyzed
About Bukalapak
Bukalapak is a major Indonesian e-commerce marketplace (one of the country's tech "unicorns"), connecting buyers and sellers across Indonesia. It maintains user account, contact, and transaction records.
Why They Hold Your Data
E-commerce marketplaces collect customer and seller identity, contact details, addresses, payment-adjacent records, order history, and marketplace communications across commerce systems.
Recent Developments
In March 2019, Bukalapak identified a breach of its backups dating to October 2017. The ~13 million-record dataset was part of a series of databases sold on the dark web by the actor "Gnosticplayers" (fourth batch). Bukalapak downplayed the exposure, but passwords (bcrypt / salted SHA-512) were among the compromised data.
Data Points Exposed
5 verified field types
Email Address
Full Name
IP Address
Password High
Username
Breach Impact
The exposure of emails, usernames, names, IP addresses, and hashed passwords for ~13 million Indonesian users creates credential-stuffing and account-takeover risk (mitigated by strong hashing) and targeted phishing. As one of the first major Indonesian datasets sold by Gnosticplayers, it fed broader credential-abuse ecosystems.
Exploitation & Downstream Threats
• Credential stuffing and account takeover against reused passwords (mitigated by strong hashing) | • Targeted phishing using exposed emails and names | • Account enrichment via IP/username linkage
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
G
Threat Actor: GnosticPlayersConfidence: Medium
Motivation: Financial
A prolific breach seller persona active around 2019 and associated with large batches of stolen account databases. Some modern reporting groups GnosticPlayers with the broader ShinyHunters data-theft ecosystem, but that relationship should be handled cautiously.
This breach is linked to the GnosticPlayers batches (2019) campaign (2019 related breaches tracked by ObscureIQ). See the full campaign analysis →
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation