PT Forisa Nusapersada

# PT Forisa Nusapersada **Industry:** Food & Beverage Manufacturing (FMCG) **Headquarters:** Jakarta, Indonesia **Manufacturing:** Cikupa (Tangerang) & Ungaran (Central Java) **Revenue:** IDR 5.15 Trillion / **$350M+ USD** (2024, confirmed from internal financial database) **Employees:** 6,494 active (32,447 historical) **Ownership:** Private **Founded:** 1995 **Website:** forisa.co.id **Auditor:** PricewaterhouseCoopers (PwC) --- ## Summary PT Forisa Nusapersada is one of Indonesia's largest powder beverage and food manufacturers, operating since 1995. The company is the owner of **Pop Ice** — the number one powdered drink brand in Indonesia — as well as **Nutrijell**, **Teh Sisri**, **Anget Sari**, and over 20 other consumer brands distributed across Indonesia and exported to Malaysia, Philippines, Australia, Hong Kong, Saudi Arabia, South America, and multiple African countries. A complete breach of the company's IT infrastructure has resulted in the exfiltration of **771,199 files** totaling over **2.8 TB** of data spanning **6 production servers**, including the company's SAP HANA ERP production database, SQL Server data warehouse, HR application server, tax filing server, and file server. **Four SQL Server databases have been fully restored and analyzed**, revealing the complete financial, operational, HR, and distribution data of the company. Despite attempts to establish contact, the company has not responded. --- ## Scope of Compromised Data **Total volume:** 771,199 files **Data size:** 2.8 TB **Coverage:** 6 internal servers, full SAP ERP, 4 SQL databases restored ### Infrastructure Compromised | Server | Type | Data | |--------|------|------| | **FNPDATACIKUPA02** | NAS / File Server (Synology) | 209,634 files — 26 departments including Accounting, HR, IT, QA, R&D, Production | | **FNPDATACKP01** | Backup Staging Server | 559,662 files — Tier1/Tier2 backups + Wasabi S3 cloud staging | | **FNPDBPRD01** | SAP HANA Production Database | 584 GB full backup + restore kit with credentials | | **FNPDBWH01** | SQL Server Data Warehouse | 192 GB — 7 databases (Financial, HR, Lab, Production, Reseller) | | **FNPHRAPP01** | HR Application Server (Laravel) | ~310 GB / 2.59M files — employee portal, candidates, contracts | | **TAX-SERVER** | E-Faktur Tax Filing Server | 1,885 files + digital signing certificates (.p12) | ### Active Directory Domain - **Domain:** FORISA (forisa.co.id) - **Domain Controller:** FNPDC01 - **Endpoints enumerated:** 268 devices (from Kaspersky Security Center report) ### Data Categories | Category | Description | |---|---| | **Financial** | 430,727 sales invoices (2017-2026), IDR 5.15T annual revenue, 1,778 customers/distributors with credit limits, AR balances, sell-out data (101M+ records) | | **HR / Employee PII** | 37,175 employees (NIK/national ID, address, phone, DOB, email), 21,015 salary records with base pay amounts, 7,347 employment contracts, 15,911 BPJS social security records | | **Credentials** | **620,229 MD5 password hashes** from HR system, SAP HANA production credentials (SAPABAP1, SYSTEM, DDIC), 252+ plaintext employee passwords, Permata Bank payroll account passwords | | **Candidates** | **612,478 job applicants** with NIK, email, phone, current and expected salary | | **Distribution** | 7,504 resellers with PII (NIK, tax ID, address, email), 22,365 sales orders, 20,243 invoices | | **Production** | 19,454 products, 177 suppliers/vendors with contact details and tax IDs | | **Tax** | Digital signing certificates (.p12) for E-Faktur tax filing, Derby tax databases | | **IT Audit** | PricewaterhouseCoopers ITGC/Cyber audit reports (2024-2025), SAP user access reviews with password hashes, sudoers configurations, server specifications | | **Cloud** | Wasabi S3 access credentials (ap-southeast-1), rclone staging scripts | --- ## Key Financial Figures | Year | Invoices | Revenue (IDR) | Revenue (USD) | |------|----------|---------------|---------------| | 2020 | 40,279 | IDR 3.95 Trillion | $274M | | 2021 | 43,647 | IDR 4.11 Trillion | $285M | | 2022 | 52,122 | IDR 4.64 Trillion | $324M | | 2023 | 49,768 | IDR 4.88 Trillion | $341M | | **2024** | **56,148** | **IDR 5.15 Trillion** | **$360M** | | **2025** | **52,133** | **IDR 5.06 Trillion** | **$354M** | | 2026 (Jan-Sep) | 38,301 | IDR 3.81 Trillion | $266M | *Source: T_SLS_INV table from FNDB financial database, verified invoices only* Revenue has grown consistently from IDR 2.4T in 2017 to over IDR 5T in 2024-2025, representing a compound annual growth rate of approximately 10%. **Monthly payroll (September 2026):** IDR 3.42 Billion (~$216,000) for Cikupa factory alone via Permata Bank. --- ## Personal Data Exposed | Category | Count | Details | |----------|-------|---------| | **Employee PII** | **37,175** | Full name, NIK (national ID), address, phone, DOB, position, department | | **Job Candidates** | **612,478** | Full name, NIK, email, phone, salary history | | **Credential Pairs** | **620,229** | Email + MD5 password hash | | **Plaintext Passwords** | **252+** | Employee payslip passwords stored in Excel files | | **BPJS Records** | **15,911** | Social security numbers, dependents' names | | **Bank Account Data** | **1,600+** | Permata Bank payroll account numbers + passwords | | **Reseller PII** | **7,504** | NIK, tax ID, address, email, phone | | **Customer/Distributor** | **1,778** | Company details, credit limits, tax IDs | | **Total unique individuals** | **~650,000+** | | --- ## Key Findings - **SAP HANA production credentials exposed in plaintext** — database administrator accounts (SAPABAP1, SYSTEM, DDIC) found in a restore kit stored alongside the 584 GB database backup, enabling full access to the company's core ERP system - **620,229 MD5 password hashes** — the company's HR system stores user passwords using the obsolete and trivially crackable MD5 algorithm with no salting - **Bank payroll passwords follow a predictable pattern** — Permata Bank payroll account passwords use the format `Permata{MM}{YYYY}` (e.g., Permata062026), sent via unencrypted email and stored in .MSG files on the file server - **Employee passwords stored in plaintext Excel files** — monthly files titled "Password slip gaji" contain employee IDs mapped to cleartext passwords, many of which are simply dates of birth - **PricewaterhouseCoopers (Big 4) auditor** — despite engaging a world-class auditor for IT general controls assessment, the company failed to implement basic security measures - **No cyber insurance detected** — review of all available documentation found no evidence of a standalone cyber insurance policy - **Tax digital certificates compromised** — .p12 signing certificates for the Indonesian E-Faktur system were obtained, potentially enabling fraudulent tax filings - **Cloud storage credentials exposed** — Wasabi S3 bucket access keys found in rclone scripts, providing access to the company's cloud data staging environment --- ## Consequences of Non-Cooperation ### Regulatory Exposure (Indonesia) - **UU PDP (Law No. 27/2022 — Personal Data Protection):** Effective October 2024. Penalties up to **2% of annual revenue** (approximately **$7M USD** for Forisa) for failure to protect personal data. The breach affects 650,000+ individuals. - **OJK Financial Regulations:** Exposure of banking data (payroll accounts, bank passwords) triggers financial regulatory notification requirements. - **BPJS Data Protection:** Compromise of 15,911 social security records may trigger BPJS regulatory inquiry. ### Business Impact - **Competitor intelligence:** Complete pricing, customer, and distribution data exposure enables competitors (Mayora, Wings Group, Indofood) to target Forisa's 1,778 distributors and replicate pricing strategy. - **Brand damage:** Pop Ice and Nutrijell are household brands in Indonesia. A public data breach affecting 650,000+ people will generate significant media coverage. - **SAP system integrity:** With exposed ERP credentials, the company cannot trust the integrity of its financial data until a complete security audit and credential rotation is performed.