Months after the pandemic hit Indonesia, a local civil society group called Indonesian Consumer Community (KKI) was busy preparing for a lawsuit against Tokopedia.

In May 2020, KKI took the billion-dollar Indonesian internet company to court over a data breach—91 million Tokopedia user accounts were circulating in darknet forums. The entire set was on offer for about US$5,000. Each account included a user ID, full name, email, phone number, and birth date. Passwords were there, too, but thankfully encrypted.

KKI made its case based on a regulation that says digital platforms must inform data owners in case of a breach, in written form, within a certain period of time.