Fore says the national ID numbers and KTP photos of its customers were not part of the leak, because its app never asked for or stored them. That is true as far as the company's statement goes, and not collecting those documents was a good decision. It is also not the part that matters most for the people on the list.
On 28 October 2026 Fore confirmed unauthorized access to the customer data behind its app. The company put the number at about 5.7 million accounts, a figure from its initial investigation. A week later, on 4 November, Komdigi said it was still analyzing and examining the report Fore filed on the day of the announcement.
What Fore actually said
According to Katadata and Fortune IDN, the data that was accessed differs from customer to customer. It can include name, email address, phone number, date of birth, gender, the address registered in the app, a PIN stored in hashed form, and purchase history made through the app. Fore says it stopped the access and secured the affected systems within 24 hours, and that card details sit on a separate platform that was not affected.
Two things are worth noting. First, this is Fore's own account, and an independent forensic review by an external cybersecurity consultant is still under way. Second, as of 28 October management said it had found no sign that the accessed data had been misused. Nobody should write that scams are already happening because of this leak. The argument is about what the data makes possible.
Why "no KTP" is cold comfort
A KTP photo is what you need to take over an identity: open a loan, register a SIM card, pass a verification check. It is valuable, and its absence is good news. But most scams aimed at ordinary people never need that level of access. They need one thing, which is for the victim to believe the caller.
Belief comes from context. A message that arrives with your correct name, your correct number and a reference to something you really bought last week does not feel like a stranger's. The leaked fields line up almost perfectly with that need. This is our own analysis, not a finding from the case: a call from "your regular cafe" about a payment problem with your last order is easy to script when the script writer has your purchase history.
The one thing such a caller still lacks is the one-time code that proves you are you. That is why Fore tells customers never to share their PIN or OTP with anyone, and why that single rule matters more than anything else on the list.
What Fore asks customers to do
Fore's advice to customers, as reported by Katadata, is short:
- Change your Fore PIN, or create one if you have none yet.
- Change the PIN on any other account that uses the same combination.
- Do not give your PIN or OTP to anyone.
- Be careful with calls, SMS, email or WhatsApp messages that claim to come from Fore.
The app now also asks for two-factor authentication when you log in from a new device. The PIN advice is more important than it looks. The PIN was stored as a hash, which is better than plain text, but anyone who reuses it elsewhere has handed the same secret to two places.
Where Komdigi and the law come in
Komdigi says Fore reported the suspected failure of personal data protection on 28 October and that it is now analyzing and examining the report. If negligence or violations are proven, administrative sanctions can follow under the personal data protection law (UU 27/2022) and the regulation on electronic systems (PP 71/2019). No sanction has been announced.
Article 46 of the same law is the part every business should read. When a personal data protection failure happens, the data controller must send written notice, no later than 3 x 24 hours, to the people whose data is affected and to the authority. The notice must say which data was exposed, when and how, and what the controller is doing about it. That duty is not limited to listed companies with millions of users. A cafe or shop that keeps a member list is also a controller of that list.
If you hold member data
The useful lesson from Fore is not about Fore. It is that every field you collect is a field that can end up in someone else's script. Article 16(2) of the same law says collection must be limited and specific, lawful and transparent. In practice that comes down to habits you can start this week.
Start with the member form. If the phone number is for sending receipts, keep it. If the full birth date is only for a birthday promotion, the day and month are enough. Then list every place the data lives. For small businesses that list is usually longer than expected: the cashier app, a spreadsheet someone exported last year, a WhatsApp group, an account of a former employee that nobody closed.
Once you know where it is, delete what you no longer use and make sure only the people who need access have it, with one account per person. Finally, write down what you would do on the day it leaks, including who sends the written notice within three days. Data that no longer exists cannot be leaked, and a plan that exists before the incident is the cheapest security control a small business has.
If you are not sure where your member data sits or who can open it, that is a reasonable thing to have checked. XETUP does this as part of a first audit of servers, account access, backups and security. You can reach us at bisnis@xetup.id or on WhatsApp at +62 823 1499 5005.