Data of 5.7 Million Fore Coffee Accounts Leaked: Risks of Hashed PINs and Steps to Take

The Fore Coffee data leak was an incident of unauthorized access to the customer data management platform of PT Fore Kopi Indonesia Tbk which affected approximately 5.7 million accounts. This is important because the data exposed, from cell phone numbers to hashed PINs, is enough for very convincing fraud and other account break-in attempts.

Fore announced this incident on Wednesday, October 28 2026, then reported it to the Ministry of Communications and Digital (Komdigi). The forensic investigation is still ongoing. This article summarizes what's confirmed, what's not, and steps users, developers, and digital business owners can take.

What really happened?

According to the company's official statement quoted by CNBC Indonesia, detikInet, and kumparan, Fore's internal team discovered unusual activity on one of the platforms used to manage customer data. Initial investigations indicate there was unauthorized access to the platform.

Fore said the illegal access was stopped and related systems were secured within 24 hours of the suspicious activity being identified. The company also appointed an independent cybersecurity consultant for the forensic investigation.

There are several things that have not been revealed to the public:

• The exact date the unauthorized access occurred and when it was detected.
• The name of the platform or vendor that was breached. The report only mentions "related platforms".
• The identity of the perpetrator and whether the data has been sold on the forum. The three main sources do not mention it.
• The root of the technical problem. The cause of the writing coil is unknown.

Fore CEO, Vico Lomar, apologized and said that protecting customer data was the company's responsibility. Management also stated that it had not found any indication of data misuse.

What data is exposed?

Fore emphasized that the affected data is different for each customer. The following table summarizes the company's claims based on news reports.

The good news is that official identity data and card data were not present in the hacked system. The bad news is, the combination of name, cellphone number, and purchase history is ideal material for social engineering. Scammers can send the message "refund for your coffee order yesterday" which feels very convincing.

Why is a "hashed PIN" still something to be wary of?

Hashing is indeed better than storing the PIN in plain text. The problem is, PINs have very little room for possibility. A 6 digit PIN only has 1,000,000 combinations. If the hash used is fast (for example SHA-256 or MD5 without additional secrets), the attacker can simply calculate the hash of all combinations and then match them.

How fast? The following simple Python script calculates SHA-256 for the entire 6-digit PIN. On the editorial test machine, the process completed in about 0.6 seconds with a single thread.

import hashlib, time

t = time.perf_counter()
for i in range(1_000_000):
    hashlib.sha256(f"{i:06d}".encode()).digest()
print(f"{time.perf_counter() - t:.2f} detik untuk 1 juta PIN")

Fore has not explained the hash algorithm, salt, or PIN length used, so we cannot conclude that customer PINs can definitely be reversed. But the general principle is clear: PINs leaked in hashed form should be considered potentially known, especially if you use the same PIN in e-wallet, m-banking, or other applications. That's why Fore asks customers to change their PIN on another account that uses the same combination.

What should Fore customers do now?

1. Change the Fore application PIN with a new combination that is not your birth date, cellphone number, or sequential pattern.
2. Change the PIN to another service if you use the same combination, prioritize e-wallet and m-banking.
3. Never share your PIN or OTP, including with parties claiming to be from Fore, the bank, or the courier.
4. Be suspicious of messages containing order details. Accurate details are not proof the message is genuine.
5. Enable 2FA on email accounts and e-wallets. Fore itself now requires 2FA when logging in from a new device.
6. Need help? Fore provides [email protected] contacts according to detikInet reports.

What are the lessons for developers and digital businesses?

1. Save PIN with slow hash and pepper

For low entropy data such as PINs, a slow hash alone is not enough because 1 million guesses can still be attempted. Add pepper: a secret key stored in KMS/HSM, separate from the database. If the database leaks but pepper doesn't, the hash cannot be tested offline. Example in Node.js using package argon2 with OWASP recommended minimum parameters (19 MiB, 2 iterations):

import argon2 from "argon2";
import crypto from "node:crypto";

// Ambil dari KMS/secret manager, jangan disimpan di database
const PEPPER = Buffer.from(process.env.PIN_PEPPER_HEX, "hex");

const peppered = (pin) =>
  crypto.createHmac("sha256", PEPPER).update(pin).digest();

export async function hashPin(pin) {
  if (!/^\d{6}$/.test(pin)) throw new Error("PIN harus 6 digit");
  return argon2.hash(peppered(pin), {
    type: argon2.argon2id,
    memoryCost: 19456, // KiB
    timeCost: 2,
    parallelism: 1,
  });
}

export async function verifyPin(storedHash, pin) {
  return argon2.verify(storedHash, peppered(pin));
}

Complete with server-side trial limits (e.g. temporary lock after a certain number of errors) and OTP for new devices.

2. Audit third-party platforms that hold customer data

This incident occurred in the "data management platform", not in the main application. Many businesses copy customer data into CRMs, marketing tools, or loyalty dashboards without the same tight controls. Take inventory: what data is sent to which vendors, who has admin access, whether SSO and MFA are mandatory, and whether access logs are kept. A similar pattern also emerged in the case of Polymarket which was hacked via a third party script.

3. Send as little data as possible

Fore's step of not storing NIK and KTP photos has proven to limit the impact. Apply the same principles: marketing tools don't need PIN hashes, and analytics dashboards don't need full addresses. Unsaved data cannot be leaked.

4. Prepare notification procedures according to the PDP Law

Article 46 of Law Number 27 of 2022 concerning Personal Data Protection requires data controllers to provide written notification to data subjects and institutions no later than 3×24 hours if data protection failure occurs. The minimum notification contains the data that was disclosed, when and how the data was disclosed, as well as handling and recovery efforts.

The technical regulations are in PP 33/2026, which according to SIP Law Firm's analysis is set for July 16 2026 and takes effect January 16 2027. According to the summary, a 3×24 hour deadline is calculated from the time a failure is confirmed based on documentation such as system logs and forensic reports, and every incident must be recorded. You can set up an incident log template like this now:

{
  "insiden_id": "INC-2026-0001",
  "dipastikan_pada": "2026-10-27T14:00:00+07:00",
  "batas_notifikasi": "2026-10-30T14:00:00+07:00",
  "data_terungkap": ["nama", "email", "telepon", "pin_hash"],
  "jumlah_subjek": 0,
  "waktu_dan_cara": "Akses tanpa izin ke platform CRM pihak ketiga",
  "penanganan": ["cabut akses", "rotasi kredensial", "paksa reset PIN", "forensik independen"],
  "notifikasi": { "subjek_data": null, "lembaga": null, "publik": null }
}

The values ​​above are just an example of the format, not Fore incident data. For platforms that also have to follow content moderation obligations, also see our review of Komdigi's 4-hour takedown rule.

5. Reduce sensitive data that you manage yourself

If your application processes ID cards, NIK, or accounts, consider validating via API and storing only the required results, not the raw documents. In the APIPedia console, APIs such as NIK parsing and account validation are available which can be used without saving a copy of the document on your own server.

FAQs

Was Fore customer credit card data leaked?

According to Fore, no. Payment information including credit and debit card numbers is stored on a separate, unaffected platform.

Has the Fore customer's NIK or ID card photo been leaked?

Fore stated that the application never asks for or stores NIK and KTP photos, so that data does not exist in the system it accesses.

How do I know if my account is among those affected?

Fore said it was contacting affected customers directly. Be careful: scammers can imitate this kind of message. Fore will not ask for a PIN or OTP, and questions can be sent to [email protected].

Can Fore be subject to sanctions?

The PDP Law regulates administrative sanctions for data controllers who violate their obligations, but the PDP supervisory agency has not yet been fully formed as of September 2026 according to SIP Law Firm. Until this article was written, there had been no statement from Komdigi regarding the follow-up to this case.

How is this data leak different from ordinary account hacking?

Account hacks usually target a single user. A data leak means a company's database or data storage platform is accessed by an unauthorized party, leaving millions of accounts exposed at once and the risk persists long after the system is secured.

Source

• CNBC Indonesia: Data of 5.7 Million Customers Leaked, Fore Ngadu to Komdigi (1 November 2026)
• detikInet: Data on 5.7 Million Fore Coffee Accounts Leaked, Customers Asked to Change PIN (29 October 2026)
• kumparan: Fore Coffee admits that its customer management website was hacked by hackers (28 October 2026)
• Pasal.id: Law Number 27 of 2022 Article 46
• SIP Law Firm: PP 33/2026 concerning Personal Data Protection