FORE CEO apologizes over data leak reportedly affecting 5.7 million app accounts

Data exposed and access blocked

Corporate Secretary Denny Ngadimin said FORE identified the incident during an internal investigation conducted October 19-27. Management said it fixed the security vulnerability and cut off unauthorized access less than 24 hours after the discovery.

The leak exposed customers' contact and profile information, including names, email addresses, phone numbers, birth dates, gender and delivery addresses, as well as transaction histories and hashed PINs. Denny said the Fore app had never stored national identity numbers, identity card photographs or payment card details.

In its October 28, 2026, statement, FORE said it had found no indication that the accessed information had been misused.

Security changes and customer precautions

FORE said its response included testing security, fixing the vulnerabilities it found, upgrading the affected platform to the latest version and adding security measures.

The company is notifying affected customers directly. It urged anyone receiving a notification to immediately change their Fore account PIN, or create one if they have not set one, and to change the PIN on any other account where they use the same code.

FORE also said the app has implemented two-factor authentication (2FA) for logins from new devices, providing an additional layer of account security.

The food-and-beverage ordering app launched on Google Play in October 2018. Katadata.co.id reported that its Google Play listing showed more than one million user downloads.

Forensic audit and regulatory notification

"We understand the concerns caused by this incident and sincerely apologise to the affected customers. Protecting customer data is our responsibility," Vico said in an official statement.

Vico said FORE would complete a comprehensive investigation and use its findings to make concrete changes to security systems and governance. The company plans to engage an independent cybersecurity consultant for a forensic audit.

Management said it had reported the incident to the Ministry of Communication and Digital Affairs (Komdigi). Vico also assured stakeholders that FORE's operations, legal standing and financial condition would not be affected.

Indonesia's Personal Data Protection Law, Law No. 27 of 2022, requires data controllers to notify affected individuals and the data protection authority in writing within 72 hours of a personal data protection failure, according to Chambers and Partners. Administrative fines can reach 2% of a controller's or processor's annual revenue for the preceding financial year.

FORE's retail business

The publicly listed food-and-beverage retailer operates the Fore Coffee and Fore Donut brands. According to its company information, the business had grown to more than 400 outlets in more than 70 cities across Indonesia and Singapore by the end of September 2026.

FORE said its April 2025 initial public offering raised more than IDR 353 billion. Net proceeds exceeded IDR 337 billion and were earmarked for new outlets, development of the Fore Donut business line and working capital.