Skip to content

My data or my agency's data has leaked

Emergency steps when personal or agency data has been spread, sold, or used by others without permission.

TLP:CLEAR ·  1 views

Your personal data or your agency's data has appeared on forums, Telegram channels, or data-selling sites, or is being used by others to commit fraud. Leaked data cannot be pulled back, so the focus is on closing the source of the leak and preventing the data from being misused.

Signs

  • A post or advertisement offers data, with sample rows that match your agency's data.
  • You are contacted by a stranger who knows your national ID number (NIK), address, or account details.
  • A service you use sends a data breach notification, or your email appears in a breach-checking service.
  • On agency systems: large data exports, database downloads, or access from foreign IP addresses appear in the logs.

Do this now

For agencies (system owners or operators):

  1. Keep evidence: the post's address, screenshots, and the sample data shown by the attacker. Do not buy or download the full file.
  2. Report it to KUTIM-CSIRT before changing anything on the server.
  3. Secure the application, web server, and database logs for the suspected period.
  4. Change passwords and API keys that have access to that data, then disable unused accounts.
  5. Compare the sample data with your systems to confirm the source, scope, and approximate timing.
  6. Prepare a notification to the data owners. Article 46 of Law No. 27 of 2022 on Personal Data Protection requires data controllers to notify data subjects and the authority in writing no later than 3 × 24 hours.

For individuals:

  1. Change the passwords of the accounts whose data was leaked and of any other accounts that use the same password.
  2. Enable 2FA on your email and financial apps.
  3. Be wary of calls, SMS, or messages that use your data to appear official.
  4. Check whether your email appears in known breaches using Have I Been Pwned.
  5. If your national ID number (NIK) or bank account details were also leaked, monitor your account transactions and notify your bank through the official call center listed on the back of your card or in the app.

Don't

  • Do not reshare links, data samples, or screenshots containing complete data in group chats.
  • Do not negotiate with or pay the data seller.
  • Do not delete logs or shut down servers before the evidence has been copied.
  • Do not publicly state the amount or type of leaked data before it has been examined, because incorrect figures are hard to correct.

Report

Report it through /lapor under the category Kebocoran / Pencurian Data (data leak / theft). Choose Kritis (Critical) if the leak involves large amounts of residents' personal data, population records, health data, or system credentials; Tinggi (High) for other agency data leaks; and Sedang (Medium) for your own personal data. Attach screenshots of the post with sensitive data masked, and write the post's address in the description. Evidence that cannot be masked can be sent encrypted to csirt@kutaitimurkab.go.id following the PGP guide.

Posts or social media accounts selling data can also be reported to aduankonten.id, run by the Ministry of Communication and Digital Affairs.

To prevent a recurrence

  • Limit data access according to role, and do not grant export rights to accounts that do not need them.
  • Do not put data files (Excel, SQL, backups) in web folders or public sharing links.
  • Record and keep access logs for sensitive data.
  • Collect only the data you need and delete data that has passed its retention period.
  • Have applications that hold personal data security-tested through a VA/pentest service request.

Report to KUTIM-CSIRT All emergency steps

Other emergency steps: