Personal Data of Over One Million Bandung Residents Allegedly Circulating Online
Another alleged large-scale data leak has surfaced, this time involving residents of Bandung City, West Java. On Thursday, March 26, 2026, the X account Vecert Analyzer, under the username @VECERTRadar, reported detecting a data leak affecting the city. According to the report, a threat actor using the alias petrusnism released a database containing detailed personal information belonging to more than one million residents. The news was later reported by Selular.ID on Tuesday, April 7, 2026. As of that report's publication, no official confirmation had been cited in the coverage.
Because there is no official confirmation yet, this information should be treated as an allegation. Leak claims circulating on social media and hacker forums are not always accurate, and some turn out to be recycled old data. Even so, a claim of this scale cannot simply be dismissed. People who may be affected should take precautions while waiting for clarity. Staying alert without panicking is the wisest approach in a situation like this.
Why This Claim Deserves Attention
Cyber threat monitoring accounts such as Vecert Analyzer typically share findings detected from various sources across the internet. Reports like these are often an early signal before an incident is addressed by the authorities. An early signal still needs to be verified, however, both by the data owner and by the relevant agencies. Verification includes checking the authenticity of data samples, their origin, and when the data was obtained. Without that process, the public has little way of knowing how large the real risk is.
What makes this allegation worrying is the nature of the data. The report says the database contains detailed personal information, not just email addresses or usernames. Detailed data allows threat actors to build a complete profile of a person. Such profiles are highly valuable to fraudsters because they make their schemes look convincing. The more complete the data an attacker holds, the harder it is for victims to tell genuine messages from fake ones.
Risks Facing Residents
The first and most likely risk is phishing. Attackers can send messages that mention a victim's full name, address, or other personal data to make them look like official communications. These messages usually try to get the victim to click a link, download a file, or hand over an OTP code. Once the victim complies, their banking, e-wallet, or social media accounts can be taken over. This pattern has been seen repeatedly after various data leaks in Indonesia.
The next risk is fraud in many forms, from people posing as government officials to fake delivery couriers. Leaked personal data also opens the door to identity theft. Attackers can use a victim's identity to sign up for certain services, apply for online loans, or create fake accounts. Victims often only find out when bills or debt collectors arrive. Beyond the financial loss, the victim's good name is also damaged, and restoring it takes time.
Preventive Steps for Residents
Bandung residents, and the public in general, can take a few simple steps to reduce their risk. These steps are relevant whether or not the alleged leak is eventually confirmed. Safe digital habits should be practiced at all times anyway. Here are some things you can do.
- Never share OTP codes, PINs, or passwords with anyone, including people claiming to be official staff.
- Double-check any message that mentions your personal data and asks for immediate action.
- Enable two-factor authentication on your email, banking, and social media accounts.
- Monitor account statements and account activity history regularly.
- Report any suspected misuse of your identity to the relevant service provider as soon as possible.
Residents should also be careful with anyone offering to check for leaked data while asking for additional personal information. Offers like that can be a follow-up tactic for harvesting more data. Only use lookup services with an established reputation. If content or accounts misusing your identity appear, document the evidence before reporting it. Well-organized evidence makes the reporting and removal process easier.
Lessons for Regional Data Managers
An alleged leak targeting the residents of a single city shows that population and public service data at the regional level is also a target. Regional systems are often run with limited resources, both in budget and in security expertise. As a result, vulnerabilities often stay open even after they are known. System operators need to map what data they store, who has access, and how backups are secured. This simple inventory is often the starting point for the most impactful improvements.
Oversight of third parties such as application vendors and hosting providers must not be overlooked either. Many incidents begin with vendor access that was never revoked or credentials shared too widely. Regular security testing can help find weaknesses before attackers exploit them. Well-kept access logs also make investigation easier if an incident occurs. These efforts align with the spirit of personal data protection set out in the law.
Data Controller Obligations Under the PDP Law
Whatever the source of the data turns out to be, this allegation is another reminder of the obligations of personal data controllers. Law Number 27 of 2022 on Personal Data Protection requires every data controller to safeguard the data it processes. Data controllers must implement technical and organizational measures to prevent unauthorized access. If a personal data protection failure occurs, the controller must provide written notification to data subjects and the relevant authorities within the time limit set by the law. That notification must at minimum state what data was exposed, when and how the incident occurred, and the steps taken to handle and recover from it.
These obligations apply to both government agencies and private entities. This means whichever party turns out to be the source of the data in this case has a legal responsibility to follow up. Transparency is also important so that residents can protect themselves before it is too late. Silence, on the other hand, only prolongs uncertainty and gives attackers room to act. Public trust in digital services depends heavily on how data controllers respond to incidents.
Awaiting Clarity While Staying Vigilant
As of the Selular.ID report, the alleged leak of Bandung City residents' data had not been accompanied by any cited official confirmation. The public is waiting for an explanation from the authorities about the authenticity of the data and its origin. In the meantime, preventive steps at the individual level remain the first line of defense. For organizations that manage large volumes of resident data, this case is a reminder to review their system security. Data leaks rarely stop at a single incident, and their effects can be felt for years afterward.
