Fore Coffee breach: up to 5.7 million customer accounts exposed, hashed PINs included
Fore Coffee disclosed on October 28, 2026 that an unauthorised party accessed its customer-data platform, exposing data from up to 5.7 million customer accounts, including names, contact details, dates of birth, addresses, hashed PINs and purchase history; payment data was not involved, and the company asks customers to change their app PIN.
What happened
PT Fore Kopi Indonesia Tbk, the listed company behind the Fore Coffee chain, disclosed on October 28, 2026 that an unauthorised party had accessed its customer-data platform. The company made the disclosure to the Indonesia Stock Exchange. Corporate secretary Denny Ngadimin said the incident was identified through an internal investigation conducted from October 19 to 27, and that management closed the security vulnerability and revoked the unauthorised access within less than 24 hours of the discovery. IDNFinancials, reporting the company’s statement, identifies the platform involved as the company’s Metabase platform.
Fore says it will work with an independent cybersecurity consultant to conduct a forensic audit, and that it has reported the incident to Komdigi, Indonesia’s Ministry of Communication and Digital Affairs. Chief executive Vico Lomar apologised to affected customers in the company’s statement. The company says it has not found indications that the accessed data has been misused so far, and its investigation is continuing. It assured stakeholders that the incident would not affect its operations.
Who is affected
Around 5.7 million user accounts on the Fore app are affected, by the company’s own figure — reporting describes the exposure as covering up to that many accounts, and the data involved varies by customer. The fields the company lists are names, email addresses, phone numbers, dates of birth, gender, registered or delivery addresses, transaction histories and hashed PINs. A hashed PIN is stored as a scrambled value rather than in plain text, but the company itself notes that hashing does not entirely eliminate the risk of misuse, which is why it is asking customers to change their PINs.
Two categories were not involved, on the company’s account. Fore says its app neither requests nor stores national identification numbers (NIK) or customer ID-card photos, so neither was exposed. Payment information, including credit and debit card numbers, is stored on a separate platform and was not touched.
How serious
The concrete risk is targeted phishing and account misuse, not direct payment theft on the facts Fore has given. Names, email addresses, phone numbers, addresses and real purchase histories give a scammer the material for messages that impersonate Fore Coffee — a fake voucher, refund or account warning that cites a customer’s real orders and address will look more convincing than a generic lure. Dates of birth add a detail often used to verify identity elsewhere. The hashed PINs are the second risk: if a PIN can be recovered or was reused, it could be tried against the customer’s Fore account or another service where the same code was used. Against that, no payment card data and no national ID numbers were involved, so this incident on its own does not hand over the means to charge a card or open accounts in a customer’s name.
What to do now
Change your Fore app PIN now — that is the company’s own request to its customers — and choose a PIN you do not use for any other app or service. If you have used the same PIN or password anywhere else, change it there as well, starting with email and banking. Open the Fore app directly, or type its address yourself, rather than following a link in a message about this incident.
Treat messages about the breach itself with care. Fore says it found no misuse of the data so far, but that position can change, and breach-themed phishing commonly follows a public disclosure: a message citing your real name, address or order history and urging you to sign in, pay or share a code should be verified through the app or the company’s official channels before you act on it.
Sources: IDNFinancials, October 29, 2026, reporting Fore’s official statement · Cybersecurity ASEAN, October 29, 2026, reporting Fore’s Indonesia Stock Exchange disclosure of October 28