Data from 5.7 Million Fore Coffee Customer Accounts Leaked
Jakarta, CNBC Indonesia — PT Fore Kopi Indonesia Tbk (FORE) has confirmed a data breach involving unauthorised access to one of the platforms it uses to manage customer data. The incident resulted in some customer information being accessed by unauthorised parties. An initial investigation indicates that data relating to up to around 5.7 million customer accounts may have been affected.
According to a disclosure to the Indonesia Stock Exchange (BEI), an internal investigation found unusual activity in the form of unauthorised access to the platform. Management said that after identifying the activity, FORE took steps to stop the access and secure the system within 24 hours.
“We understand the concern this incident has caused and sincerely apologise to the affected customers. Protecting customer data is our responsibility,” PT Fore Kopi Indonesia Tbk chief executive Vico Lomar said on Wednesday (28 October 2026).
The types of data affected vary by customer and may include names, email addresses, telephone numbers, dates of birth, gender, addresses registered on the Fore app, hashed PINs and purchase histories made through the app.
However, management said the Fore app has never requested or stored national identity numbers (NIK) or photographs of identity cards (KTP). “We also do not store payment information, including credit or debit card details, which are held on a separate platform, so that data was not affected,” management said.
The company has carried out security testing, addressed identified vulnerabilities, updated the platform to its latest version and introduced additional security measures.
To ensure a thorough and independent investigation, FORE has also appointed a professional cyber-security consultant to conduct further forensic work on the Fore app, the platform concerned and other relevant information technology systems. The investigation is ongoing.
FORE has reported the incident to Indonesia’s Ministry of Communication and Digital Affairs (Komdigi) and said it would continue to co-ordinate with the relevant authorities in accordance with applicable regulations. The company is also contacting affected customers directly.
As a precaution, FORE is asking customers who receive a notification to change their Fore account PIN immediately, or create one if they do not have one, and to change the PIN on any other accounts where they have used the same code.
The Fore app has also introduced two-factor authentication (2FA) for log-ins from new devices as an additional layer of protection. The company said it has so far found no indication that the accessed information has been misused.
Customers are urged to be cautious of telephone calls, text messages, emails and WhatsApp messages purporting to come from FORE. The company also advises customers not to share their PIN or one-time password (OTP) with anyone.
“Our focus now is on supporting affected customers, completing a thorough investigation and ensuring that the lessons from this incident lead to tangible improvements in our systems and security governance,” Vico said.