Key points. Komdigi, the Indonesian National Police, and BSSN are investigating allegations of illegal buying and selling of personal data following widespread reports of a data breach involving government officials in early October 2026. BSSN stated that the data circulating online is old data that has resurfaced, but the investigation is still ongoing.
The Ministry of Communication and Digital Affairs is coordinating with the Indonesian National Police and the National Cyber and Cryptography Agency to investigate the alleged illegal buying and selling of personal data that became a hot topic in early October 2026. An official statement from Jakarta was issued by Alexander Sabar, Director General of Digital Space Oversight at Komdigi, through a written statement to the media on Friday, October 2, 2026. This step was taken following reports of an alleged leak of personal data belonging to Minister of Communication and Digital Affairs Meutya Hafid. In its press release, Komdigi did not specifically state that the collaboration with BSSN was directly related to those reports. Follow-up coverage appeared in various national media outlets on Saturday, October 3, 2026, and Tuesday, October 6, 2026.
The Origins of the Alleged Data Breach
These allegations first surfaced after cybersecurity expert and content creator Mr. Bert revealed them via his Instagram account @realmrbert on Friday, October 2, 2026. He stated that the minister’s personal data was circulating online and being offered for sale through data-trading channels, including Telegram, for approximately Rp 2,000. Mr. Bert emphasized that the disclosure was intended to urge the government to strengthen its response to data breaches, not to embarrass the official in question. Although the issue has been widely discussed, the truth of these allegations has not yet been independently confirmed, according to a report by Investortrust. Therefore, the public needs to distinguish between circulating claims and the verified findings of authorized agencies.
BSSN’s Explanation Regarding Old Data
BSSN provided an initial explanation that the data breach currently making headlines involves old data that has resurfaced. This explanation was conveyed by Komdigi in a written statement to the media. Sulistyo, BSSN’s Deputy for Cybersecurity and Cryptography for Government and Human Development, stated that preliminary analysis indicates the data is a combination of publicly available information and data from several previous leaks. In other words, the circulating data does not originate from a new hacking incident. This statement was reported by Katadata on Tuesday, October 6, 2026. Nevertheless, BSSN continues to investigate the circulation of this data in collaboration with Komdigi and law enforcement agencies.
Why Old Data Remains a Risk
The assessment that the data does not stem from a new incident does not automatically mean the impact on data subjects is minimal. Personal information that has previously been leaked can still be collected, combined, and then resold to parties intent on misusing it. Combining old data with publicly available information can create a fairly comprehensive profile of an individual. Such profiles have the potential to be used for fraud, account takeovers, or identity theft.
Therefore, investigating the sources and means of data circulation is still considered necessary without waiting for a new leak to occur. This approach aligns with the steps taken by Komdigi and BSSN, namely tracing who is collecting and trading data, rather than merely assessing the age of the data. For the general public, this case serves as a reminder that data that has been leaked never truly disappears from circulation.
Enforcement Actions by Komdigi, the National Police, and BSSN
Komdigi stated that it continues to follow up with investigations and enforcement actions even though the circulating data is referred to as “old data.” The ministry has also coordinated with the police to investigate various websites found to be buying and selling personal data. BSSN is further coordinating with Komdigi and law enforcement agencies to trace the sources and channels through which the data is being circulated. This division of roles demonstrates that addressing the alleged illegal sale of data involves several agencies acting within their respective jurisdictions. Komdigi also views data security threats as an evolving cross-border challenge that requires a collaborative response.
Appeal Not to Share Personal Data
In its statement, Komdigi urged the public not to participate in the dissemination of others’ personal data. This appeal relates to Law No. 27 of 2022 on Personal Data Protection, as the dissemination of personal data without a legitimate basis may violate the provisions of that law. Komdigi also reminded the public that anyone can become a victim in the event of a data breach or misuse. Sharing screenshots or files containing personal data—even with the intention of issuing a warning—still has the potential to exacerbate the impact on the data subjects. A safer approach is to report findings through official complaint channels rather than disseminating them in public forums.
A Series of Alleged Data Breaches Throughout 2026
This case is not the only alleged data breach to surface throughout 2026. On Friday, February 6, 2026, Deputy Minister of Communication and Digital Affairs Nezar Patria stated that the Inspector General’s Office of the Ministry of Communication and Digital Affairs was investigating an alleged data breach involving job applicants during the ministry’s recruitment process, as reported by Kompas.tv citing Antara. On Thursday, March 26, 2026, the Vecert Analyzer account reported an alleged leak of the population database for the city of Bandung, West Java, which was said to contain more than one million individual records. Selular.ID reported this news on Tuesday, April 7, 2026. Based on available sources, both incidents remain unconfirmed at this time.
Impact on Data Subjects and Organizations
For individuals, the circulation of personal data can open the door to fraud, account takeovers, and even identity theft. This risk is greater when old data is combined with other publicly available information. For organizations, data breaches erode the trust of customers and partners and require compliance with personal data protection regulations. Claims circulating on data trading channels may not accurately reflect the actual situation; therefore, verification by authorized agencies remains necessary before determining the scale of the breach.
As of the writing of this article, no official investigation results regarding the source of the data circulation have been found in the news reports we reviewed. Further developments will depend on the results of investigations by Komdigi, the Indonesian National Police (Polri), and the National Cyber and Cryptography Agency (BSSN) into websites and channels that buy and sell personal data.
