PT Fore Kopi Indonesia Tbk, the listed company behind the Fore Coffee chain, has confirmed that someone without permission got into one of the platforms it uses to manage customer data. The company says its early findings show the incident affected data from "up to approximately 5.7 million customer accounts." Fore said this in a bilingual press release dated 28 October 2026, and CNBC Indonesia reports the same figures were in a disclosure to the Indonesia Stock Exchange. Every outlet covering the story uses the same number. Some headlines turn it into "5.7 million records" or "5.7 million customers", but the company's own figure counts app accounts, not unique people, and it is a ceiling ("up to") rather than a final total. CEO Vico Lomar apologised publicly: "We understand the concerns caused by this incident and sincerely apologise to the affected customers. Protecting customer data is our responsibility." No threat actor has claimed the breach, and Fore has not named one.
What Happened
Fore's statement says an internal investigation found "unusual activity in the form of unauthorized access" on a platform used to manage customer data. The company says it cut off that access and secured the affected system within 24 hours of spotting it. It then:
- ran security testing
- fixed the vulnerabilities it found
- updated the affected platform to its latest version
- added further security controls
IDNFinancials adds two details that Fore's published statement does not include. It names the affected system as the company's Metabase platform, an open-source business intelligence and dashboard tool. It also quotes Corporate Secretary Denny Ngadimin as saying the internal investigation ran from 19 to 27 October. Fore's press release says only "one of the platforms the Company uses to manage customer data" and gives no dates for when the access began or was found. Read both details as IDNFinancials' reporting, not as confirmed by the company.
Fore has hired an independent cybersecurity firm to carry out a forensic investigation of the Fore app, the affected platform and other related IT systems. That work is still going on. The company has reported the incident to Indonesia's Ministry of Communication and Digital Affairs (Komdigi) and says it will keep working with the relevant authorities. Komdigi has not made any public statement. Fore says it is contacting affected customers directly. According to detikInet and ThedailyID, the company has found no sign so far that the accessed data has been misused.
IDNFinancials reports that management told stakeholders the incident will not affect FORE's operations, legal standing or finances.
What Was Taken
Fore says the exposed fields differ from customer to customer and may include:
- full name
- email address
- phone number
- date of birth
- gender
- address registered in the Fore app
- hashed PIN
- purchase history in the Fore app
Fore says the app has never asked for or stored national identity numbers (NIK) or photos of ID cards (KTP). It also says payment card details are kept on a separate platform and were not affected.
Even without identity documents or card numbers, the data is valuable to attackers. Names, phone numbers, birth dates and home addresses together with purchase history give scammers a strong base for convincing phishing, smishing and WhatsApp scams. The hashed PINs are the most serious item. A PIN has very few possible values (often 4 to 6 digits), so a hash of it can be cracked quickly unless it was salted and processed with a deliberately slow algorithm. Fore has not said which hashing method it used. detikInet notes that hashing "does not fully eliminate the risk of misuse."
Why It Matters
This looks less like a break-in to a core production system and more like an exposure through an analytics tool. If IDNFinancials is right about Metabase, it matches a pattern defenders keep running into. BI and dashboard tools are often given broad read access to production customer databases so analysts can query them. They are then deployed with less hardening and patching than the main application, and sometimes left reachable from the internet. Anyone who compromises the dashboard gets everything the dashboard can read.
Fore's statement that it "updated the relevant platform to its latest version" as part of its fix suggests, though does not prove, that an outdated version played a part. Metabase has had serious publicly disclosed vulnerabilities before, including a pre-authentication remote code execution flaw in 2023 (CVE-2023-38646) that was widely exploited against servers exposed to the internet. Nobody has linked that CVE or any other specific flaw to this incident.
The incident also comes under Indonesia's Personal Data Protection Law (UU PDP), which is now fully in force. Fore has reported to Komdigi. Whether there will be enforcement action, and what notification deadlines apply, has not been made public.
The Attack Technique
The way in has not been disclosed. What is known so far:
- Entry point: a customer data management platform, which IDNFinancials identifies as Metabase. Fore has not publicly confirmed the platform's name.
- Weakness: Fore says it "addressed the vulnerabilities found" and updated the platform to the latest version. It has not said whether the cause was an unpatched software flaw, stolen or default credentials, a misconfigured instance exposed to the internet, or something else.
- Dwell time: unknown. IDNFinancials gives a 19 to 27 October investigation window, but nobody has said when the unauthorised access started.
- Attribution: no group has claimed responsibility, and as of publication no sale or leak of the data on criminal forums has been publicly reported.
Fore's statement and ThedailyID both say the app requires two-factor authentication when a user logs in from a new device. That should make it harder to take over accounts with cracked PINs alone, but it does not reduce the phishing risk created by the exposed contact details.
What Organizations Should Do
- List and lock down every BI and analytics tool. Find all Metabase, Superset, Redash, Grafana and similar instances. Take them off the public internet, put them behind SSO or a VPN, and patch them as quickly as your customer-facing apps.
- Limit what dashboards can read. Connect BI tools to read replicas or masked views with the fewest permissions needed, not to full production tables containing contact details and credential hashes. Credential material such as PIN or password hashes should never be reachable from an analytics layer.
- Hash short secrets properly. For PINs, use per-user salts with a memory-hard algorithm (Argon2id, scrypt) or a server-side pepper kept in an HSM. Also apply strict attempt limits on the server. A fast, unsalted hash of a 6-digit PIN is effectively plaintext.
- Monitor bulk query and export activity. Alert on unusually large result sets, new API tokens, unfamiliar admin logins and off-hours queries on BI platforms. Data theft through a dashboard looks like normal analyst activity unless you set a baseline.
- Prepare for the phishing that follows. If you hold Indonesian consumer data, warn customers and frontline staff about scams that impersonate Fore, and watch for credential-stuffing attempts that reuse PINs or emails from this incident against your own login pages.
- Advise affected users clearly. Fore is telling notified customers to change their app PIN (or set one if they never did) and to change the same PIN anywhere else they use it. Any organisation whose users overlap with Fore's customer base should give the same advice.
Sources: 5.7 million customer records leaked, FORE boss apologises IDNFinan... | Fore Mengambil Langkah Penanganan dan Memperkuat Keamanan Menyusul... | Fore Takes Remedial Action and Strengthens Security Following Unaut... | Fore Coffee Alami Peretasan, 5,7 Juta Data Pelanggan Terdampak | Data 5,7 Juta Akun Fore Coffee Bocor, Pelanggan Diminta Ganti PIN | Data 5,7 Juta Akun Pelanggan Fore Kopi (FORE) Bocor | Fore Coffee Confirms Data Breach Affecting 5.7 Million Customer Acc... | Data 5,7 Juta Pelanggan Fore Bocor, Perusahaan Langsung Investigasi