blank

⚠️ 🇮🇩 🛂 🗄️ PREVENTIVE ALERT – ALLEGED EXPOSURE OF 1.03M CLIENT FILES FROM A VISA AGENCY IN INDONESIA (ACTOR: FUGHT19707551) [STATUS: ALLEGED / UNCONFIRMED / THREAT ACTOR: FUGHT19707551 / DATE: OCTOBER 28, 2026] The centralized cyber-intelligence system has intercepted a commercial offer on underground forums, posted on October 28, 2026, by the user Fught19707551. The post announces the availability for sale of a massive data dump—comprising 1,025,482 items organized into 30,999 client folders (with a total compressed size of 613 GB)—stolen from a visa and travel agency in Indonesia that managed its client intake via the "Backend-as-a-Service" platform, Supabase. According to the threat actor’s description, the database suffered from misconfigured Row-Level Security (RLS) policies—with the "anonymous" role left open—and a storage bucket configured as public. This allowed for the complete extraction of identity documents, passports, KTPs (Indonesian national ID cards), family registration cards (KK), bank statements, and biometric records belonging to visa applicants for international destinations (such as South Korea, Japan, the United States, the United Kingdom, the Schengen Area, etc.), collected between June 2024 and August 2025. It should be strictly noted that the occurrence of this intrusion, the actual vulnerability within the agency’s Supabase infrastructure, and the overall authenticity of the exposed records have not been officially confirmed by the affected company or by cybersecurity authorities in Indonesia. As this involves offers for sale on underground forums, the actual status of the infrastructure remains speculative and unconfirmed. Threat Actor: Fught19707551 Victim / Target: A visa and travel agency based in 🇮🇩 Indonesia (utilizing Supabase infrastructure). Sector: 🛂 Travel Services, International Visa Processing, Immigration Consulting, and Digital Identity. Date of Publication: October 28, 2026. Nature of the Incident: Alleged exfiltration and commercialization of a massive 613 GB repository containing personally identifiable information (PII), official identity documents, and financial data from over 30,000 client files. 🛡️ PREVENTIVE TECHNICAL RECOMMENDATIONS FOR CONTAINMENT (SOC / CSIRT / SUPABASE ADMINISTRATORS) Audit and Immediate Restriction of RLS Policies in Supabase: Organizations using Supabase or similar architectures must urgently review their Row-Level Security (RLS) policies and ensure that storage buckets are not configured with unrestricted public access for anonymous roles. Identity Protection and Alerts for Affected Individuals: Implement monitoring and alert mechanisms for individuals whose passports, NIK (national ID) numbers, and financial documents appear in the dataset, in order to mitigate serious risks of identity theft and cross-border financial fraud. 🖥️ CENTRALIZED THREAT MONITORING SYSTEM Intelligence System: analyzer.vecert.io Quickly check your security at: monitor.vecert.io Inquiries and services: vecert.io/contact #Indonesia #VisaAgency #SupabaseMisconfiguration #DataLeak #DataBreach #BreachAlert #DatabaseLeak #PII #Passport #KTP #IdentityTheft #DarkWeb #Hacking #ThreatIntel #ThreatIntelligence #InfoSec #CyberAlert #VECERT #SOC #CSIRT #Unconfirmed #SecurityAlert #CyberDefense #CyberRisk