BSSN states circulating personal data is from old leaks, investigation ongoing
Jakarta (ANTARA) - The National Cyber and Crypto Agency (BSSN) has confirmed that the personal data circulating recently, which is alleged to be a new data breach, does not originate from a new incident but rather from previous leaks.
Sulistyo, the BSSN Deputy for Cyber Security and Cryptography for Government and Human Development, stated in a briefing in Jakarta on Monday that initial analysis shows the data is a combination of open-source information and data from several previously occurred breaches.
This data, he said, was subsequently re-collected and redistributed.
“As soon as this initial information emerged, our team immediately conducted an analysis. The results of the initial analysis show that the circulating data breach does not stem from a new incident. The data is a compilation of various open information and previous data breaches, which were re-collected and then redistributed by certain parties,” he said.
Despite it not being a new leak, BSSN is continuing to follow up on the circulation of this data. BSSN will further coordinate with the Ministry of Communication and Digital (Kemkomdigi) and law enforcement agencies to trace the source and the means of its distribution.
“We are in alignment with Kemkomdigi. Although this is old data, we do not take it lightly. Data that has previously leaked can still be misused if it is resold. Therefore, investigation and enforcement efforts are ongoing,” said Sulistyo, who also serves as the head of the Gov CISRT, the cyber incident response team for the government sector.
BSSN also urged the public not to participate in spreading screenshots, posts, or snippets of anyone’s personal data, including that of public officials.
“Personal data remains personal data, regardless of the owner, their social or economic background, and even if it has previously circulated from various open information sources. Every time we reshare it, we contribute to extending the risk. Let us protect our digital space together by not participating in making it go viral,” said Sulistyo.
BSSN also requested that the public take several simple steps to protect their accounts and personal data, including changing passwords for important accounts, especially if the same password has been used for a long time or across multiple services.
Furthermore, users should use different passwords for every account, utilise password managers, and activate multi-factor authentication (MFA) on email, social media, and financial services.
Additionally, the public is advised to be wary of phone calls, messages, or links claiming to be from institutions that request OTPs or personal data, to avoid using services or bots that offer “data checks” or the sale of personal data, and to avoid uploading personal data to social media.
“Cybersecurity is a shared responsibility. The government continues to strengthen system protection and enforcement. Simple habits such as changing passwords, activating two-step verification, and not uploading personal data serve as a very significant first line of defence,” said Sulistyo.