Recycled Data Leaks: What Indonesian Organizations Do

In early October 2026, reports of another personal data leak spread across Indonesian social media. The Ministry of Communication and Digital Affairs (Komdigi) and the National Cyber and Crypto Agency (BSSN) say the data is old and has simply been recirculated, not newly hacked. Recycled data leaks are still dangerous, and your organization should know why.

What happened in early October 2026

According to Periskop on 2 October 2026, Komdigi is investigating alleged illegal trading of personal data that resurfaced online. It is working with the national police to deal with sites and channels offering the data, while BSSN provided an initial assessment of what was circulating.

Alexander Sabar, Komdigi’s Director General for Digital Space Supervision, said the leak currently making noise consists of old data that has been stirred up again, as quoted by Tirto on 3 October 2026. Investigation and enforcement continue regardless.

Several outlets reported that the data allegedly belonged to the communications minister. Okezone noted that Komdigi’s own press release did not explicitly tie the investigation to that case. For this article, the victim matters less than the pattern.

Old data, but the risk is not over

Liputan6 on 5 October 2026 quoted Sulistyo, BSSN’s Deputy for Government Cybersecurity and Cryptography and Human Development. In his words, the data is a compilation of various open information and earlier leaks that was gathered again and redistributed.

BSSN still treats the case as serious: data that has leaked before can be misused when it is sold again. Picture someone assembling one file from five old leaks. Each piece may look harmless, but together (name, phone number, address, workplace) they are enough to craft a scam message that sounds very convincing.

This is the part people often miss. “Is this a new breach or an old one?” matters to a forensic team. To the person getting a call from a scammer, the answer changes nothing.

This is not an isolated incident

Periskop also cites Pusiknas Bareskrim figures of 75 cases in July and 66 in August 2026. In September 2026, West Java’s provincial police broke up two illegal data-trading cases and arrested four suspects. An identity-tracing service found in the case was rented for about Rp700,000 per account per month. Please verify that figure against the original source before quoting it, since Periskop is summarizing others.

In other words, getting hold of someone else’s personal data no longer takes hacking skills. A subscription is enough. For organizations, that shifts the risk picture: the threat is not only sophisticated hackers, but also ordinary people with cheap access to data that is already out there.

Why old data still sells

Personal data has a long shelf life. Phone numbers, email addresses, and workplaces rarely change, so data from a leak several years ago is often still accurate today. That is why data sellers do not need a new breach. They can merge, clean, and repackage old data so it looks fresh.

For a school or a local government office, the consequence is concrete. A leaked list of teachers, parents, or staff can be used to write messages that mention the right principal or the right school event. Such messages feel legitimate, and people tend to click. That is why awareness training matters as much as security tools, and why it needs repeating regularly rather than becoming a once-a-year formality.

What Indonesia’s Personal Data Protection Law says

Komdigi stressed that leaked data remains protected personal data. The legal basis is Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Law No. 27 of 2022 on Personal Data Protection, or the PDP Law). According to Periskop, the criminal penalties include:

• unlawfully obtaining or collecting data: up to 5 years in prison and/or a fine of up to Rp5 billion;
• unlawfully disclosing data: up to 4 years and/or a fine of up to Rp4 billion;
• unlawfully using data: up to 5 years and/or a fine of up to Rp5 billion.

Data controllers or processors that breach their obligations can also face administrative fines of up to 2 percent of annual revenue. That last point matters most for private schools, companies, and service providers: if you handle other people’s data, you share responsibility for it.

Komdigi’s other message is simple but often ignored: do not help spread other people’s personal data. Reposting a screenshot of “leak evidence” in an office group chat or on social media can be a problem of its own.

What this means for your organization

This case is a reminder that a leak is never truly over. Data exposed three years ago can reappear in a new package. A few realistic, low-cost steps:

Treat old data as still live. Your staff, teachers, parents, or students may already be affected by leaks from other services. Do not rely on details like birth dates or a mother’s maiden name as the only proof of identity.

Turn on two-step authentication. BSSN urges multi-factor authentication on email, social media, and financial apps, plus a different password for every account. For an organization, start with email accounts and any system that holds staff or student data.

Train people, not just systems. Komdigi warns about APK files from unknown numbers, which can steal passwords, PINs, and one-time codes. A concrete case: a “meeting invitation” or “grade announcement” arriving as an APK in a school WhatsApp group. One live simulation in the teachers’ room often beats ten slides.

Collect only the data you need. The less you store, the less can leak. Review registration forms and legacy systems that still hold data from earlier years.

Prepare for leak claims. Name one responsible person, set up a way to verify claims (Komdigi stresses that leak claims need verifying first), and decide who speaks publicly. On 20 September 2026, for example, the Directorate General of Taxes denied a claim that taxpayer data had leaked, after checking a sample that did not match its system structure. Claims can be wrong, but you only know after you check.

If you need help assessing weak points or drafting an incident response procedure, our cybersecurity services can help. For public agencies, see our digital government solutions, and for schools, education technology.

Frequently asked questions

Is leaked data still protected by the PDP Law?

Yes. Komdigi emphasized that data already in circulation remains protected personal data. Obtaining, disclosing, or using it unlawfully can still be prosecuted under the PDP Law.

What should I do if I come across “leaked data” on social media?

Do not reshare it, and do not use “data check” services or bots. Verify through official channels first, and report sites selling data to Komdigi. Both BSSN and Komdigi ask the public not to spread fragments of leaked data.

Should small organizations worry?

Yes, but there is no need to panic. Criminals often use combined data to target almost anyone. Start simple: MFA, unique passwords, short training sessions, and limits on what data you keep.

Final thoughts

News like this is easy to read as a passing drama. The main lesson is calmer and practical: data that has gotten out cannot be pulled back, so what you can do is make it less useful to scammers. If you would like to talk through the state of your systems without pressure, feel free to get in touch for an easygoing chat.

Sources

• Periskop, “Data Bocor Lama Dijual Lagi, Kemkomdigi Usut dan Blokir Situs Ilegal” (2 October 2026)
• Tirto, “Komdigi Usut Kebocoran dan Jual Beli Data Pribadi” (3 October 2026)
• Okezone, “Sebut Data Menkomdigi yang Beredar Data Lama, Komdigi Gandeng BSSN Usut Jual Beli Data Pribadi” (3 October 2026)
• Liputan6, “BSSN Bongkar Fakta Dugaan Kebocoran Data Menkomdigi Meutya Hafid” (5 October 2026)