A Jakarta-based payment processor confirmed Tuesday that attackers stole the names, national IDs, and partial card numbers of roughly 2 million customers after infiltrating a third-party vendor's update server. The breach, reported to Indonesia's Otoritas Jasa Keuangan (OJK), marks the largest domestic financial data exposure since the 2023 national ID leak that affected 1.2 million records.
The company, PT Maju Sejahtera Payments, which serves three major banks and two government payment portals including the e-KTP digital registration system, didn't notice the intrusion for 17 days. According to a security analyst who reviewed the disclosure, the attackers used a signed but malicious software update to drop a remote-access tool inside the vendor's network. From there they moved laterally into the payment processor's database and exfiltrated a compressed file of customer records. The analyst asked not to be named because the investigation is ongoing and bound by non-disclosure agreements with clients.
The stakes are immediate and potentially severe for millions of Indonesians. Indonesia's digital banking users don't have a credit freeze mechanism like the United States nor a centralized fraud-alert service. National ID numbers, known as e-KTP numbers, are linked to bank accounts, mobile phone registrations, and government benefits. When criminals pair these records with the phone-number datasets already traded on dark-web markets, they can open new bank accounts, order SIM cards, and file fraudulent government claims in victims' names. Identity fraud will spike within weeks, according to fraud specialists who have studied similar breaches in Southeast Asia.
How the Attack Spread Through a Trusted Update Cycle
The vendor was a regional IT maintenance firm in West Java called Mitra Telkom Indonesia. The company handled routine server updates for PT Maju Sejahtera Payments under a two-year contract signed in early 2023. Attackers compromised the vendor's build pipeline on September 14, when a developer's laptop was left unattended at a coworking space in Bandung. A phishing email opened hours later installed malware that spread through the vendor's internal network.
That email appeared to be from Microsoft, warning of a failed login attempt that needed immediate verification. The attachment exploited a vulnerability in Chrome's PDF rendering engine to install an initial backdoor. The malware lived on the laptop for three days before the attackers noticed the vendor used the same admin credentials across its build server and developer workstations. Those credentials gave them access to the software update signing system.
Attackers modified a routine patch file that was supposed to update monitoring software on payment servers. The patch included a legitimate code change plus a hidden module that opened a reverse shell. The file carried a valid digital signature because the attackers obtained the signing certificate from the compromised laptop. PT Maju Sejahtera Payments' automated update system accepted the patch without human review because the signature was valid.
"It is not a zero-day," said Andi Wijaya, a Jakarta-based incident responder at SecurIT. "It is a failure of supply-chain verification. The update was signed, but nobody checked what it actually did." Wijaya leads the firm's breach-response practice and has investigated over 30 supply-chain attacks in the past two years, most involving Indonesian financial institutions.
The backdoor opened a persistent connection to a command server physically located in Vladivostok, Russia, based on the IP geolocation data forensics team recovered. From there, attackers used stolen credentials to move laterally into the payment processor's database, which contained customer records dating back to 2018. The database held 8,400,000 customer records in total, but only 2,000,000 customers who had made transactions in the previous quarter were compromised.
The 17-day dwell time is typical for supply-chain intrusions but still too long. The company's internal alert rules focused on endpoint malware signatures, not on unusual data transfers to unknown IP addresses. By the time an external auditor from PwC flagged an anomalous 320 GB upload to the Russian IP address, the attackers had already exfiltrated the customer database and wiped their tracks from the system logs.
What Banks Are Doing Now to Contain the Damage
PT Maju Sejahtera Payments notified the three affected banks on October 24, two days after the external audit confirmed the breach. The notifications went to BRI, Mandiri, and BNI, which together hold 68 percent of Indonesia's banking market share. Each bank issued public statements within 48 hours, meeting the 72-hour window required by Indonesia's new data-protection rules that took effect in July 2024.
Banks have frozen new card applications for affected customers and started manual identity verification for high-value transfers above 10 million rupiah. Customers with flagged accounts must visit physical branches with government-issued photo IDs to verify their identity before they can use digital banking services. The requirement for physical presence is slowing down the onboarding of new customers in urban areas where bank branches are already understaffed.
Still, the response is reactive. Customers are told to change passwords and watch for suspicious SMS messages claiming to be from banks. There is no universal fraud-alert service in Indonesia, so a customer in Surabaya must call their bank individually to block a newly opened account using their leaked ID. Small businesses that rely on digital payments report delays of several days in processing customer refunds because their payment gateways are linked to the compromised processor.
The government is pressing for a mandatory security audit of every financial-services vendor with access to bank networks. That could affect hundreds of small IT firms across Java and Sumatra, many of which were subcontractors during the pandemic when digital infrastructure needs surged. Vendors with annual revenue under one billion rupiah may struggle with the cost of compliance, which critics argue could create barriers for legitimate local companies.
A Pattern of Supply-Chain Attacks Across Southeast Asia
This is not an isolated incident. In August 2026, a Malaysian telecom provider reported that attackers used a similar supply-chain method to access subscriber billing records for at least 500,000 customers. The attackers compromised a third-party billing software vendor in Kuala Lumpur and embedded malicious code in a routine update distributed to mobile operators.
In September, the Philippines' central bank warned that third-party vendors represent the weakest point in the region's banking infrastructure after detecting unauthorized transactions totaling 250 million pesos that originated from a compromised payroll-processing service. The Philippines' BSP issued circular 1172 which requires banks to conduct annual security assessments of all vendors handling sensitive customer data, but implementation remains inconsistent.
Indonesia's banking sector has expanded rapidly during the pandemic years. Digital-account openings grew 34 percent year-over-year through August 2026, according to Bank Indonesia's quarterly financial inclusion report. Faster growth usually means faster shortcuts in vendor oversight. The rush to digitize government benefits distribution and small business lending created a culture of accepting vendor assurances over documented security controls.
The Regulatory Gap Between Law and Enforcement
Indonesia passed its Personal Data Protection Law in 2022, but implementing regulations for financial data have not been finalized as of October 2026. The OJK has issued guidelines recommending multi-factor authentication, network segmentation, and regular penetration testing for payment processors, but these remain advisory rather than mandatory requirements. The government has discussed creating penalties that match the scale of a breach, but parliamentary budget procedures have delayed funding for enforcement activities.
That gap allows vendors to skip detailed security reviews when contracts are small or local. Many of the affected vendors are family-owned businesses in suburban Jakarta that serve a handful of banks but lack dedicated security staff. They rely on antivirus software and basic firewall rules, which proved inadequate against an attack that started with a physical breach of a developer's laptop.
What Comes Next for Affected Users and the Banking Sector
Customers cannot undo a leaked national ID number. They can only limit the damage. Banks should issue free credit-monitoring services, which they have not yet announced. The government should publish a clear list of which records were taken, so people know if they are affected. Without transparency, customers will make assumptions that may lead to unnecessary panic or false security.
The attack also exposes a deeper problem: Indonesia's financial infrastructure depends on too many small vendors with weak security practices. Until banks enforce independent audits of every vendor with network access, the next breach is a matter of time, not luck. Security experts say this incident should trigger a sector-wide review of vendor management practices, not just punishment of the compromised company.
For users who want to act now: change banking passwords immediately, enable two-factor authentication where available by SMS or authenticator app, and call your bank to confirm whether your account is in the exposed set. The processor said it will publish a full list of affected account numbers by Friday, October 31, 2026.
A new security audit at the vendor is scheduled for October 30. If it finds the same gaps, the banks will have to decide whether to pull the contract or pay for a fixed version of a system they never fully understood. The vendor has already secured a loan from a local bank to cover incident-response costs, but the loan terms reportedly include personal guarantees from the owner's family members.
More on this: OJK regulation updates and Bank Indonesia digital financial inclusion report. Reuters covered similar supply-chain breaches in 2024 affecting regional banks: Reuters analysis.