Fore Coffee reports data breach affecting 5.7 million customer accounts

share on

twitter /
facebook /
linkedin /
- email
- telegram
- whatsapp
- wechat
- pinterest
- line
- snapchat
- reddit

Fore Coffee has disclosed a data breach affecting up to 5.7 million customer accounts, prompting an investigation by Indonesia's ministry of communication and digital affairs (Komdigi) into potential violations of the country's personal data protection regulations.

The incident involved unauthorised access to a customer data management platform used by the coffee chain. According to Fore Coffee CEO Vico Lomar, an internal investigation identified unusual activity on the platform, with the company containing the unauthorised access and securing the affected systems within 24 hours of detecting it.

The compromised information varies by customer and may include names, email addresses, telephone numbers, dates of birth, gender, addresses registered on the Fore app, hashed PINs and purchase histories made through the application.

Don't miss: Fore Coffee, Tahilalats turn cat friendships into an interactive pop-up

Fore Coffee said its application does not collect or store national identification numbers (NIK) or photographs of identity cards (KTP). Payment information, including credit and debit card details, is also held on a separate platform and was not affected by the incident.

The company has since conducted security testing, addressed identified vulnerabilities, updated the affected platform to its latest version and introduced additional safeguards. It has also appointed an external cybersecurity consultant to conduct a more extensive forensic investigation covering the Fore app, the affected platform and other relevant IT systems.

As of 28 October 2026, the investigation was still ongoing. Fore Coffee has reported the incident to Komdigi and is coordinating with the relevant authorities. It has also contacted affected customers directly.

As part of its response, the company has advised customers who received notifications to change their Fore app PINs, or create one if they have not already done so. Those using the same PIN across multiple accounts have also been advised to change their credentials elsewhere.

The Fore app has additionally introduced two-factor authentication (2FA) for logins from new devices. The company said it had not identified any indication that the accessed information had been misused.

However, the incident has attracted regulatory scrutiny. Komdigi confirmed on 4 November that it was examining Fore Coffee's report, which the company submitted on 28 October.

No party has been identified as responsible for the breach so far. Komdigi noted that under Indonesia's Personal Data Protection (PDP) Law No. 27 of 2022, oversight of compliance and enforcement of personal data protection requirements falls under the authority of the institution responsible for personal data protection.

Should an investigation establish negligence or violations of data protection obligations, the relevant parties could face administrative measures or sanctions under the applicable regulations, including the PDP Law and Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions.

Fore Coffee has also urged customers to remain alert to unsolicited calls, SMS messages, emails and WhatsApp messages impersonating the company. Customers have been reminded not to disclose their PINs or one-time passwords (OTPs) to anyone.

Acknowledging the concerns raised by the incident, Vico apologised to affected customers and reiterated the company's responsibility to safeguard their information.

"We understand the concerns caused by this incident and sincerely apologise to the affected customers. Protecting customer data is our responsibility," he said.

"Our focus now is to support affected customers, complete a thorough investigation, and ensure that the lessons from this incident translate into tangible improvements to our security systems and governance."

share on