Data Leak Cases and the Risks Lurking

Data Leak Cases and the Risks That Lurk

Cases of personal data leaks still occur in Indonesia. Some 1.3 million users' data from the Electronic Health Alert Card (e-HAC) application of the Ministry of Health is suspected to have leaked. The data is roughly 2 GB in size. The leak of e-HAC user data was first revealed by cybersecurity researchers from VPNMentor on 15 July. The Ministry of Health has confirmed that e-HAC user data was leaked. The Head of the Data and Information Centre, Anas Ma'ruf, said the leaked e-HAC user data came from the old e-HAC application, which has not been used since July 2021.

In May 2021, the data of hundreds of millions of BPJS Kesehatan members was also suspected to have been hacked and sold on the Raidforums forum for around Rp 84 million. In April 2021, the personal data of around 130,000 Facebook users in Indonesia was suspected to have leaked and been spread on an amateur hacker site.

Earlier, in April 2021, the personal data of around 130,000 Facebook users in Indonesia was suspected to have leaked and been spread on an amateur hacker site. Then in September 2020, the personal data of around 5.8 million users of the RedDoorz application in Indonesia was sold.

Looking at the cases above, it can be concluded that Indonesia is in a data leak emergency. Living in a fully digital era, everyone must be more careful and vigilant in all activities on the internet. This is especially so for anything related to the spread of a person's personal data, which could be stolen or misused for crimes such as fraud and even breaking into bank accounts. 

"There are several causes of data theft in the digital world. Because people are still unfamiliar with personal data protection or are even unaware that they have been spreading it around," said Benny Daniawan, a Information Systems lecturer at Universitas Buddhi Dharma, at the Digital Literacy webinar for the Kabupaten Bekasi region, West Java I, in a press release received by Industry.co.id. He also said that people are not aware of how dangerous it is if personal data falls into the wrong hands. Internet users' awareness in Indonesia of the importance of personal data protection is currently still lacking. 

Quoting a report by CNN Indonesia on 8 January 2021, social media analyst of Drone Emprit and Kernels Indonesia, Ismail Fahmi, said that a number of people do not understand the potential crimes resulting from personal data leaks. Such data includes full name, place and date of birth, address, telephone number and email.

Threats that could potentially occur are scams and phishing. Scam is an act of fraud that tries to convince users, for example telling users they have won a certain prize that they can get if they give a certain sum of money. Meanwhile phishing is a fraud technique that lures users, for example into giving their personal data without realising it by directing them to a fake site.

Another danger is that the personal data taken can be used for social engineering and even profiling (creating user profiles). If the data is processed, the big data can be analysed, which is useful for profiling the population.For example, based on age and demographics of the population by location, hobbies, and even gender. This big data can be used for political outreach or advertising targets on social media. This is similar to what Cambridge Analytica did with Facebook user data. The company used profiling of US citizens to target certain articles at users. These articles contained opinion steering so that citizens ultimately supported the then presidential candidate Donald Trump.

Telephone number data can also be bought and sold for telemarketing purposes. So it is no surprise if someone receives a phone call offering a service or product. Strangely, the caller already knows their full name even though they have never been affiliated with the company at all. In addition, spam SMS smelling of fraud, from prize offers onwards, is also quite annoying. People can become telemarketing 'victims' once their mobile number data has been spread. A further danger that can result from the theft of mobile number data is bank account break-ins; this mode is carried out by hacking the victim's WhatsApp account by asking for the OTP code. 

Another danger that can also threaten is the misuse of personal data to take out online loans. Perpetrators will apply for loans on online loan applications using data that has already leaked. First, hackers must be able to collect KTP (identity card) data from the leaked data. Then hackers can apply for loans to withdraw a sum of money from online loan applications whose verification systems are poor.

Cybersecurity expert from CISSRec, Pratama Persadha, stated that telephone number data and the like can be used to break into social media accounts, banking accounts or other services. For example, to break into digital payment services. Pratama said the method is quite easy: the perpetrator just logs in with the phone number and asks for a one time password (OTP) code. The perpetrator can then call the victim and pose as Tokopedia or another platform the victim uses to ask for that OTP code. "This method often succeeds in taking over victims' accounts, just by knowing the registered mobile number," said Pratama.

So, what can people do to minimise the impact that could arise because their personal data has already leaked?

Cybersecurity expert from Vaksincom, Alfons Tanujaya, said that there is indeed not much people can do once their data has leaked. However, there are a few small steps that should be taken immediately, among them securing various accounts by changing passwords regularly.. This is because there is a tendency for people to use passwords derived from their personal data such as date of birth. In addition, activate two-step verification or two-factor authentication and avoid using public or free WiFi. Installing up-to-date antivirus software is also recommended in case there is malware. Also, use a different password for every online account, including e-commerce and social media.

Mata Banua newspaper web link: https://matabanua.co.id/2021/09/23/kasus-kebocoran-data-dan-risiko-yang-mengintai/

Mata Banua newspaper e-paper link: https://drive.google.com/file/d/1qFpeLsLbIqEvz7ehxT9pcqy_gizP77gt/view