- A dark web seller alleges he has 5.7 million Bank Jatim customer records, but no independent verification has confirmed the leak.
- The data contains some details such as national ID numbers, which if combined with financial data could create serious identity theft risks.
- Bank Jatim customers should monitor their accounts closely and follow other safety rules to avoid potential scams.
A threat actor has posted an advertisement on a dark web forum claiming to possess a massive database linked to the mobile banking platform of Bank Jatim. The seller states the alleged dataset contains almost 5.7 million customer records.
The purported database includes highly sensitive personal information. According to the listing on the dark web platform, the exposed fields cover details, such as full names, the country’s National Identity Numbers (NIK), gender details, dates and places of birth, education history, professional backgrounds, phone numbers, and additional banking-related identifiers.
The post also includes a sample structure that allegedly shows customer demographic and personal information.
What the Leaked Data Contains and Why It Matters
The combination of national identity numbers with personal contact details and financial identifiers creates a serious risk for affected individuals. Financial sector databases rank among the most valuable assets on cybercriminal markets. Criminals can use this type of data for identity theft, financial fraud, account takeover attempts, social engineering schemes, and phishing campaigns.
The dark web seller claims the data comes from Bank Jatim’s mobile banking ecosystem. Bank Jatim, officially PT Bank Pembangunan Daerah Jawa Timur Tbk, serves as one of Indonesia’s regional financial institutions. The bank’s mobile platform, known as JConnect, allows customers to conduct financial transactions digitally.
Security analysts note that even unverified claims of this magnitude can trigger real-world harm. Attackers can launch phishing attacks with this information as a story to entice victims.
Cybercriminals may reach out to potential victims posing as fraud prevention officers for banks and use real personal information from the hack to create a false sense of security and gain access to mobile banking credentials or one-time passwords from the target.
The dark web post’s sample structure suggests a well-organized relational database rather than random data fragments. This level of organization raises concerns about the potential authenticity of the claim, though no independent verification has confirmed the dataset’s existence.
No Independent Verification Yet
Cybersecurity monitoring services have clearly stated that the authenticity of the dataset remains unverified at this time. No technical proof, breach validation, or forensic evidence has independently confirmed the claims. Daily Dark Web explicitly notes that it has not independently verified the authenticity of the claims or the source of the data.
The dark web listing may contain overestimations or recycled datasets from past breaches; also, threat actors sometimes combine and rearrange old data as new leaks to lure buyers. Security experts advise treating unverified dark web claims with caution until forensic analysis confirms the breach.
Past incidents involving Indonesian financial institutions have shown that data can leak from third-party vendors rather than core banking systems. In a previous statement regarding a different incident, Bank Jatim explained that cybercriminals intruded on supporting application systems, not the bank’s core system. The bank assured customers that data integrity remained protected and that customers could continue transactions safely.
Indonesia’s Personal Data Protection Law imposes strict requirements on data fiduciaries. If investigators confirm this breach, Bank Jatim could face legal consequences under the law, as the regulation requires data controllers to implement adequate security measures and report breaches to authorities within specific timeframes.
Similar enforcement actions are happening elsewhere. German police shut down the relaunched Crimenetwork darknet marketplace, demonstrating how authorities worldwide are cracking down on dark web crime.
The Indonesian government has also been progressing its data protection framework through a draft regulation on the Personal Data Protection Agency, which will oversee enforcement of the PDP Law.
What Bank Jatim Customers Should Do Now
Security experts recommend that Bank Jatim customers utilize various strategies for protecting their accounts. First, they advised that customers regularly monitor their bank statements for any transactions that are unauthorized.
Second, customers should never disclose their passwords, PINs, or one-time passcodes to anyone, even if someone contacted them and told them that they represent the bank. Third, the JConnect application must be the only banking application customers should use for transactions and communication.
Finally, customers should be cautious of any form of contact, such as unsolicited phone calls, WhatsApp messages, and emails requesting personal information. Attackers often use social engineering techniques by referencing accurate personal information to appear legitimate. If something appears suspicious, hang up and call Bank Jatim directly at their authorized contact numbers.
Banking cybersecurity professionals indicate that careless actions from customers will continue to defeat the effectiveness of even the most secure banking systems.
Financial institutions in Indonesia face ongoing issues concerning data protection – many continue to operate with multiple disjointed security systems, resulting in lengthy times to detect and respond to security events.
As a result, security professionals recommend the use of a ‘zero trust’ architecture, where every access request to the institution will have a continuous verification process instead of the traditional single login approach.
This alleged incident at Bank Jatim, if confirmed, adds to the growing attacks against Indonesian organizations. The Bank Syariah Indonesia (BSI) suffered a cyber-attack in 2023, and a breach also hit the BPJS Kesehatan, all raising concern about the safety of personal data throughout Indonesia.
