Fewer Breached Accounts in Indonesia, but Far from Safe
The latest report from cybersecurity company Surfshark has once again put Indonesia in the spotlight over data breaches. The report, covered on Saturday, September 5, 2026, found that 300,416 accounts in Indonesia were affected by data breaches during Q2 2026. That is a 67.2 percent drop from Q1 2026, when the figure reached 915,746 accounts. At first glance, the decline looks like good news for internet users in the country. Compared with the same period last year, however, the picture looks different.
In Q2 2025, the number of affected Indonesian accounts stood at 209,552. That means the Q2 2026 figure actually rose 43.4 percent year on year. These two comparisons send opposite messages and need to be read together. The quarterly decline may reflect a major incident that inflated the previous quarter's numbers. The annual increase, meanwhile, shows that pressure on Indonesian users' data has not truly eased.
Indonesia's Position in ASEAN
Within Southeast Asia, Indonesia ranks second with 300,416 affected accounts. Vietnam takes first place with 375,907 accounts, while the Philippines is third with 216,669 accounts. All three countries share large internet user populations and fast-growing digital services. The more services that store user data, the larger the attack surface available to threat actors. The ranking also shows that data breaches are a regional problem, not just a single country's issue.
For Indonesia, second place is hardly something to be proud of. The gap with Vietnam is not especially wide, so the order could change next quarter. More important than the ranking is how the number of affected accounts trends over time. Quarterly data helps show direction, but it is not enough to assess the overall state of security. Careful interpretation is needed to avoid a false sense of security.
Lessons from the Historical Figures
Surfshark also recorded much larger historical figures for Indonesia. In Q3 2024, affected accounts reached 16.69 million. Two years earlier, in Q3 2022, the figure was 13.97 million. Against those peaks, the Q2 2026 number is indeed much smaller. Even so, this history shows that a major spike can happen at any time when a single incident hits a service with a broad user base.
A single quarter with a lower figure is therefore not enough to conclude that there has been a structural improvement. A fundamental improvement can only be claimed if the decline holds consistently over the long term and comes with real changes in data governance. Without that evidence, the quarterly drop is better viewed as a pause. Businesses and users should stay alert. History shows that one large breach can reshape the statistics within days.
Real Risks Behind Every Account
Every breached account represents a person whose data could be misused. Information such as email addresses, phone numbers, and passwords can be used to break into other accounts through credential stuffing. The same data often fuels more convincing phishing because it contains the victim's personal details. In some cases, breaches lead to scams that use the victim's name to target family members or colleagues. The damage goes beyond financial loss and extends to personal reputation.
For companies, a customer data breach carries both legal and business consequences. Law Number 27 of 2022 on Personal Data Protection requires data controllers to safeguard the data they manage. When protection fails, data controllers are also obliged to notify data subjects and the relevant authorities. Beyond sanctions, lost customer trust is often harder to rebuild. Negative coverage of a breach can also linger in search engine results for a long time.
Steps Worth Taking
Individual users can start by checking whether their email address has appeared in a breach through a trusted lookup service. The next step is to change any password that has been reused across multiple services. Other habits also help reduce risk significantly. They are all simple, but the payoff is large when practiced consistently.
- Use a unique password for every service and store them in a password manager.
- Enable two-factor authentication, especially for email, banking, and social media.
- Be wary of messages asking for OTP codes or login links, even if they appear to come from an official source.
- Limit the personal information you share publicly on social media.
For companies, the priority is to make sure the data they collect is actually necessary and is stored with adequate protection. Encryption, restricted access rights, and regular audits are non-negotiable foundations. Companies also need to prepare incident notification procedures in line with the PDP Law before an incident actually happens. Monitoring for company data appearing on breach forums also helps detect problems earlier. The sooner a breach is discovered, the better the chance of limiting its impact.
Data controllers also need to consider the long-term effect on their corporate image. A company name tied to a breach can keep surfacing every time the public searches for information about its services. Crisis communications should therefore be prepared alongside the technical plan. Messages that are honest, prompt, and paired with remediation steps tend to be better received. Delayed explanations, by contrast, only deepen suspicion.
Reading the Trend with a Clear Head
Surfshark's Q2 2026 report carries two messages at once. On one hand, the number of affected accounts fell sharply from the previous quarter. On the other, it is still higher than the same period last year and places Indonesia second in ASEAN. Both facts need to be held together so that policy and business decisions are not built on premature optimism. Vigilance remains the most sensible stance until data from the next few quarters shows a clear direction.
For policymakers, this data can inform an evaluation of how the PDP Law, now in force, is being implemented. For businesses, the report is a reminder that security investment cannot be scaled back just because the numbers are down. For the public, good account hygiene remains the first line of defense. Data breaches are a shared problem that requires every party to play its part. The next quarterly report will show whether this decline continues or proves temporary.
