Tokopedia tokopedia.com Tokopedia data breach: what happened and what to do
In April 2020, data from Indonesia's largest online store, Tokopedia, was posted online. Have I Been Pwned counts over 71 million email addresses with names, genders, birth dates and passwords stored as SHA2-384 hashes.
View all 13,115 breaches- Breach date
- 17 Apr 2020
- Affected
- 71,443,698
- Data exposed
- Dates of birth, Email addresses, Genders, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In April 2020, Tokopedia, Indonesia's largest online store, suffered a data breach. 15 million rows of data were posted online, and 76 million more rows were later provided to Have I Been Pwned in July 2020. In total the data held over 71 million unique email addresses.
Tokopedia said it had detected an attempt to steal data from its servers, that passwords remained protected and that no payment data was leaked. Indonesia's communications minister urged the company to improve its security.
What was exposed
The data included email addresses, names, genders, birth dates and passwords stored as SHA2-384 hashes. A hash is a scrambled form of a password, but weak ones can still be guessed.
What it means for you
Reused passwords are the main risk. Criminals try leaked email and password pairs on other sites. Names and birth dates also make phishing more believable.
Where the 91 million figure comes from
You may see 91 million in news stories. That was a seller's claim about a larger set of records, and Tokopedia's statements didn't confirm it. This page uses Have I Been Pwned's count of over 71 million unique email addresses.
What to do if you were in it
- 1
Change your Tokopedia password, and anywhere you reused it
Use a unique password for each account, ideally from a password manager.
- 2
Turn on two-factor login
An authenticator app or passkey stops most takeovers even if a password has leaked.
- 3
Expect phishing that mentions the breach
Emails, texts and calls that use your real details look convincing. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Tokopedia breach?
If you had a Tokopedia account in 2020, possibly. Have I Been Pwned lists over 71 million email addresses, and you can search yours there or with a free Serus scan.
What was exposed?
Email addresses, names, genders, birth dates and passwords stored as SHA2-384 hashes.
Should I change my password?
Yes. Hashed passwords can still be guessed, especially simple ones. Change it on Tokopedia and on any site where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
