The Fore Coffee data breach is the unauthorised access to PT Fore Kopi Indonesia Tbk's customer-data platform, disclosed to the Indonesia Stock Exchange on 28 October 2026 and affecting up to about 5.7 million FORE app accounts. The data that may have been exposed varies by customer and includes names, email addresses, phone numbers, dates of birth, gender, delivery addresses, hashed PINs and purchase or transaction history. Payment card data was not affected, and national ID numbers and ID-card photos were not stored on the app and were not exposed. No misuse of the accessed data had been found so far at the time of disclosure, and the investigation remained ongoing. The disclosure was reported by Cybersecurity ASEAN on the same basis: a listed company disclosure, a customer-data platform, and a field list in which email addresses sit alongside phone numbers and order details.
Disclosure to the Indonesia Stock Exchange
PT Fore Kopi Indonesia Tbk, the listed Indonesian food and beverage retail operator behind Fore Coffee, disclosed the incident to the Indonesia Stock Exchange on 28 October 2026. IDNFinancials identifies the affected system as the company's Metabase platform and reports that FORE Corporate Secretary Denny Ngadimin described an internal investigation conducted from 19 October to 27 October 2026. The company said it stopped the unauthorised access within 24 hours of identifying the suspicious activity. The 19 October to 27 October window is the internal investigation period reported by the company, and no source read for this article states when the unauthorised access began. IndonesiaNow reports that the company also implemented two-factor authentication for logins from new devices, and that it had begun contacting affected customers directly.
Data reported as exposed
The field list reported for the incident is a list of data that may have been exposed, not a confirmed record of what was copied from the platform for each customer. IndonesiaNow reports the same variation by customer and the same fields: names, email addresses, phone numbers, dates of birth, gender, delivery addresses, hashed PINs and purchase or transaction history. The figure of up to about 5.7 million is the company's upper estimate of affected FORE app accounts, not a confirmed count of records copied out of the platform. No source read for this article confirms which fields applied to which customers, and no source confirms whether data was copied out of the platform at all. The reporting consistently describes the incident as unauthorised access, and this article keeps that wording rather than presenting exfiltration as a confirmed fact.
Data reported as unaffected
Fore Coffee said payment information, including credit and debit card numbers, was unaffected because payment data is stored on a separate platform. The company also said its app neither requests nor stores national ID numbers, known as NIK, or customer ID-card photos, so those items were not exposed. The exposed field list still includes names, email addresses, phone numbers, delivery addresses and purchase or transaction history. No source read for this article gives a separate count for customers whose payment data or identity documents were checked and cleared, because the company position is that those categories were not held on the affected platform in the first place.
Phishing risk from the exposed fields
A name, an email address and a phone number, combined with a delivery address and a purchase history, provide the details needed for a message that references a real service, a real order pattern and a real delivery location. The company warned customers about fraud attempts by SMS, WhatsApp, email and telephone from parties claiming to represent Fore Coffee. The mechanism by which names, addresses and order details are turned into convincing messages is described in the guide on how phishing uses your leaked email. Public breach databases record exposed email addresses after incidents of this kind, and Have I Been Pwned is a public database used for that check. The leak-tracing mechanism, by which a unique address per service identifies the service that leaked it, is described in the guide on which website leaked my email.
Fore Coffee warned customers about fraud attempts by SMS, WhatsApp, email and telephone from parties claiming to represent the company. The company advised customers never to share PINs or one-time passcodes and not to click suspicious links requesting account information. A message that quotes a real name, a real delivery address or a real purchase pattern and then asks for a PIN, a passcode or account details matches the fraud pattern the company described, even where the quoted details are accurate.
Measures advised to customers
Fore Coffee urged customers to change their app PIN immediately, and customers who use the same PIN on other services were advised to change those PINs as well. The company noted that PINs are stored using a hashing method rather than as plain text, and that hashing does not entirely eliminate misuse risk, which is why the PIN change was advised. Customers were also advised to stay alert to fraud attempts and never to share PINs or one-time passcodes, and not to click suspicious links requesting account information. Loyalty and ordering apps hold delivery addresses and purchase history alongside contact details, and the guide on how to protect your email for loyalty programs covers keeping that kind of account separate from a primary inbox. The general breach-response order for an exposed email address is set out in the guide on what to do when your email is in a data breach.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Investigation and reporting
FORE reported the incident to Komdigi, the Ministry of Communication and Digital Affairs, and appointed an independent cybersecurity consultant to conduct a forensic audit. CEO Vico Lomar apologised to affected customers, and the company said it had not found indications that the accessed data had been misused at the time of disclosure. That statement is a finding at disclosure time, not a final conclusion, because the forensic audit was still to report and the investigation remained ongoing. The company has not stated when the unauthorised access began, how it happened, whether data was copied out of the platform, which customers had which fields exposed, or when the forensic audit will report. The primary Indonesia Stock Exchange notice itself was not directly reachable in the reporting read for this article, which rested on secondary reporting, so the figures and field list above remain company statements as carried by those outlets until the primary notice and the audit findings are published.
Top comments (0)