The potential breach of eHAC – an app developed to help with COVID-19 contact tracing – was brought to light by encryption provider vpnMentor, which wrote in a report on Monday that the data included contact details, ID card details and COVID-19 test results.

Health Ministry data and information center head Anas Ma’ruf said on Tuesday that the potentially flawed eHAC system had been inoperative since July 2, and gave an assurance that it was separate from the eHAC system integrated with the widely used COVID-19 tracking app PeduliLindungi.

“The government asks everyone to uninstall and delete the old and separate eHAC app,” he said.

Authorities suspect the breach occurred on a third party’s system, but could only verify this after conducting a “digital forensic audit”, he added in a statement, without further elaboration.

He went on to say that the safety of the operational eHAC system was “guaranteed”. The system’s server infrastructure was located in the national data center secured by the communications ministry and the National Cyber and Encryption Agency (BSSN).

Communications ministry spokesman Dedy Permadi confirmed the probe to The Jakarta Post, while National Police spokesman Sr. Comr. Argo Yuwono confirmed it to other local media outlets.

In the report, vpnMentor, which discovered the leaked database on July 15, blamed the breach on the developers’ failure to implement adequate data-privacy protocols.

After confirming the records’ authenticity, the provider contacted the Health Ministry, Indonesia Computer Emergency Response Team (CERT) and eHAC hosting provider Google on July 21, July 22 and July 25, respectively, to present the findings, but none of them responded.

Subsequently vpnMentor contacted the BSSN on Aug. 22, which responded that same day and took down the server on Aug. 24, reads the report.

“The massive amount of data collected and exposed for each individual using eHAC left them incredibly vulnerable to a wide range of attacks and scams,” wrote the provider.