In Response to Data Breach Allegations, Bandung City Government Implements Principle of Prudence

Responding to the recent data breach issue that has captured public attention in Bandung City, the Bandung City Government (Pemkot Bandung) has voiced its concerns and suggested that the potential breach may have occurred at the central level, as similar cases have been reported in several other cities across Indonesia.

“I am worried that this happened at the central level, because it has also occurred in several other cities. Nevertheless, Pemkot Bandung is not standing idle. We are continuously taking anticipatory steps by strengthening coordination with the central government and the national data centre managers to prevent the misuse of citizens’ data,” stated Bandung Mayor Muhammad Farhan on Wednesday (8/4).

Furthermore, Farhan added that Pemkot Bandung is also partnering with law enforcement agencies to ensure firm action against any parties proven to have committed violations. Thus, anyone who leaks data can be dealt with immediately.

“In efforts to strengthen the system at the local level, we are applying the principle of prudence in data management. One of them is by not storing data independently. We only collect data and then hand it over to the national data centre,” he explained.

Farhan noted that, as the party responsible for collecting data, Pemkot Bandung has a duty to ensure that the collection process is carried out transparently and based on the consent of the public.

Pemkot also ensures that citizens who provide data do so in a conscious and willing state.

Previously, allegations of a population data breach circulating on social media (medsos) caused an uproar among Bandung residents. This was due to thousands, and allegedly millions, of identity data being said to be freely circulating. However, Pemkot Bandung immediately denied any involvement of their system.

In its official statement, Pemkot Bandung through the Civil Registry and Population Agency (Disdukcapil) assured that the issue of the alleged population data breach circulating on social media did not originate from the Disdukcapil Bandung City server. The issue arose after a cybersecurity account on social media on 29 March 2026 posted claims regarding the alleged circulation of a large amount of population data.

THOROUGH EXAMINATION

This information then triggered various speculations in the public sphere. In response, Pemkot Bandung immediately conducted a thorough examination of the system and database on servers within the Disdukcapil Bandung City environment and coordinated with relevant parties, including the National Cyber and Crypto Agency (BSSN).

“Based on the results of technical analysis and referring to a letter from BSSN to the Bandung City Computer Security Incident Response Team (CSIRT) through the Bandung City Communication and Informatics Agency (Diskominfo), several fundamental inconsistencies were found in the data claimed to be circulating,” explained the Head of Diskominfo Bandung City, Henryco Arie Sapiie, on Monday (6/4).

First, Henryco continued, the circulating data does not specifically contain only residents of Bandung City, as it also includes addresses from Bandung Regency. This indicates that the dataset does not come from a single population administration source belonging to Bandung City. Second, the structure and naming of data elements do not match the standards of the Population Administration Information System (SIAK) officially used in population administration management.

“Third, there are differences in date writing format, where the SIAK system uses a two-digit number format for the month, whereas in the circulating data, a different format is found. This difference further strengthens the indication that the data does not come from the official Disdukcapil system,” he emphasised.