Coretax Data Breach Claim: Dark-Web Seller Offers Access to 10.5 Million Indonesian Tax Return Records
Coretax data breach claim: a seller called Marlanwg offers access to Indonesia's tax system and 10.5 million tax return records. The tax office has not confirmed it.
A dark-web seller using the name «Marlanwg» is offering access to Coretax, the system run by Indonesia's Directorate General of Taxes (DJP), and says it holds 10,490,677 annual tax return (SPT) records from 8,418,148 taxpayer ID numbers. None of it has been verified.
What the seller claims
Harian Kompas reported that the listing asks about US$3,500. Besides the tax returns, the seller claims 23,214 VAT refund records and 17,124 receipt photos carrying names, passport numbers and bank account details, plus a way into DJP's Oracle databases and its verification link to Dukcapil, the civil registry. The threat monitor VECERT flagged the listing on X as an alleged sale of a 0-day exploit and «10M+ taxpayer records».
Kompas reports no data sample from this listing. Pratama Persadha of the research centre CISSReC read the listing as a sale of system access and told the paper the chance that records have already leaked is «cukup kecil» (fairly small).
No word from the tax office
Kompas put questions to Director General Bimo Wijayanto and spokesperson Inge Diana Rismawanti, and neither had replied by 19:00 WIB on Sunday 8 November. Coretax itself was offline from 17:00 WIB on 7 November to 18:00 WIB on 8 November for maintenance DJP had announced in advance. The notice doesn't mention any incident.
Earlier leak claims at the tax office
In September 2024, after Bjorka offered about six million NPWP records, DJP said six years of access logs showed no sign of a leak straight from its systems. Coretax is a different matter. In October 2025 Finance Minister Purbaya Yudhi Sadewa admitted Coretax data had been «dijual di luar» (sold outside) through a gap in the system, and said the ministry had hired Indonesian hackers to test it. Then in September 2026 Rismawanti dismissed a sample of Coretax logins posted on X: «jelas ini bukan dari sistem Database DJP» (clearly not from the DJP database).
The same name in Malaysia
«Marlanwg» is also the alias on the Bank Rakyat defacement of 6 November, where the note claimed a sample of the bank's data that hasn't been published. Malaysia's communications minister said that incident was «limited to web defacement».
Nothing public shows the defacer and the Coretax seller are one actor.
More news
Bank Indonesia Cyber Alert: Payment Operators Told to Report Incidents Faster as OJK and BI Activate Response Team
Bank Indonesia cyber alert: the central bank told payment operators to tighten security and report incidents faster on 9 November, as OJK and BI activated a joint response team.
BIR Hacked Claim Puts the Leak at 10 Million Taxpayers; the Bureau Says It Is Still Assessing
BIR hacked claims now put the leak at more than 10 million taxpayers. The figure is unverified, and the bureau said on 9 November it is still assessing the situation.
Fraud Charges for Four Men Accused of Using a Singapore Home to Seek S$6 Million in Mortgage Loans
Fraud charges in Singapore: four men are accused of pledging a home as collateral for over S$6 million in loans without its owner knowing, using a forged NRIC.