Personal data of 279 million Indonesians were reportedly leaked. A Raid Forum account with the username kotz offered the data for sale, claiming that they have the private information of 279 million Indonesians, including their ID card numbers, phone numbers, e-mail addresses, full names, home addresses, as well as salary details. 20 million records include personal photographs.

kotz also uploaded free samples comprising data of one million users on file-sharing sites for anyone to see. When asked why there are 279 million dataset when Indonesia’s total population is 273 million, kotz said that the data includes that of the deceased.

Nuice Media (@nuicemedia) also brought this issue up on Twitter. Replying to their tweet, a curious Twitter user reached out to kotz who said that they got the data from BPJS Kesehatan. kotz added that the selling price is 0.15 bitcoin or about $6,000.

The Communication and Information Ministry held a meeting to address this issue with BPJS Kesehatan board of directors. At the meeting, BPJS Kesehatan reported that according to its investigation, the agency has only 222.4 million users in its database. However, according to an investigation by the ministry, the sample dataset is identical with BPJS Kesehatan’s database.