Indonesia e-commerce giant PT Tokopedia has been hacked with the stolen data being offered for sale on the dark web.

Discovered and publicized over the weekend by data breach monitoring firm Under the Breach, the hack is believed to have taken place in March. Some 91 million customer records are being offered for sale with the data stolen including full name, username, email address, location, gender, phone number and hashed passwords.

Tokopedia, which along with being Indonesia’s biggest e-commerce provider is also one of the country’s few tech unicorns alongside companies such as Traveloka and Ovo. The company, which has raised $2.9 billion in funding and includes SoftBank and Alibaba among its main investors, has partially confirmed the hack.

“We found that there had been an attempt to steal data from Tokopedia users,” a spokesman for the company said in a statement. “However, Tokopedia ensures that crucial information such as passwords remains successfully protected behind encryption.”

The company added that it’s continuing to investigate the alleged hacking further but it’s recommending that users change their passwords as a precaution. No financial information such as payment cards and e-wallet information is believed to have been stolen.

UPDATE: same actor is now selling the full database with allegedly 91,000,000 records for $5,000 on the Darknet.

This is really bad, make sure you change your passwords for other services in case you are re-using passwords. pic.twitter.com/bGOnAhmQ7e

— Under the Breach (@underthebreach) May 2, 2020

The data was found for sale by a member of Raid Forums, a dark web site that sells stolen data. According to HackRead, as of 4 p.m. EDT today, the stolen data has had two buyers already with one leaving positive feedback. The report also notes that the same hacker is also offering to sell credentials for Unacademy, Chatbook, The Daily Chronicle and Knock CRM.

Photo: Jon Russell/Flickr