The Indonesia Stock Exchange (IDX), known locally as Bursa Efek Indonesia (BEI), has issued a stern and urgent advisory to all capital market participants to heighten the security protocols surrounding their brokerage accounts. This warning follows a concerning rise in unauthorized account access incidents throughout 2025 and the opening months of 2026, which have resulted in the illicit sale of shares and the depletion of investor assets without the consent of the rightful owners.
Irvan Susandy, the Director of Trading and Member Regulation at the IDX, highlighted the gravity of the situation during the Capital Market Summit & Expo (CMSE) 2026 held on Saturday, November 7, 2026. Addressing an audience of industry professionals and retail investors, Susandy emphasized that the integrity of the market is currently being tested by cyber-adversaries who exploit human fallibility rather than just technical vulnerabilities in the trading platforms themselves.
The Anatomy of Account Takeovers
The phenomenon of unauthorized account access, often referred to in the cybersecurity industry as "Account Takeover" (ATO), has become a significant headache for regulators and brokerage firms alike. According to the IDX, the modus operandi of these attacks typically involves the exploitation of weak authentication practices.
In many documented instances, investors have fallen victim to sophisticated phishing campaigns, or more commonly, the use of predictable, static passwords that have not been updated for years. The human element remains the weakest link in the security chain. Irvan Susandy noted that many investors maintain a lax attitude toward their digital credentials, often treating their financial trading accounts with the same level of security as a social media account.
Furthermore, the practice of sharing login credentials with third parties—whether they be assistants, spouses, or financial consultants—has been identified as a major contributor to security breaches. By delegating access to individuals who may not be as vigilant with their own digital security, investors are inadvertently creating entry points for malicious actors to harvest credentials and infiltrate brokerage systems.
A Timeline of Escalating Cybersecurity Risks
The recent surge in security concerns did not happen in a vacuum. Throughout 2025, the Indonesian capital market witnessed a steady increase in the digitalization of financial services, with more retail investors entering the market through mobile applications. This rapid adoption, while beneficial for market liquidity and financial inclusion, also expanded the "attack surface" for cybercriminals.
Early 2025 saw a scattered increase in reports of suspicious trading activity, which were initially dismissed by some observers as individual user errors. However, by mid-2025, the frequency of these reports began to alarm regulatory bodies. The IDX, in collaboration with the Financial Services Authority (OJK), initiated a series of investigations into the security protocols of various brokerage firms.
By the fourth quarter of 2025, it became evident that the breaches were not isolated. A pattern emerged where accounts were being drained of liquid assets and shares were being sold off during periods of low market volatility to avoid detection. As 2026 began, the issue moved to the forefront of the IDX’s regulatory agenda, culminating in the comprehensive warning issued during the November CMSE 2026 event.
Supporting Data and Industry Vulnerability
The vulnerability of retail investors to cyber-threats is corroborated by broader trends in the global fintech sector. Cybersecurity research firm Cybersecurity Ventures has noted that as the value of digital assets increases, so does the motivation for cyber-attacks. In the Indonesian context, the shift toward a 100% electronic trading environment has made the security of the "Single Investor Identification" (SID) and the associated brokerage accounts paramount.
Data from the Indonesian Ministry of Communication and Informatics has indicated that financial-sector data breaches have risen by approximately 22% year-on-year. While the IDX itself maintains robust server-side security, the "last mile"—the connection between the investor’s device and the brokerage platform—remains susceptible. If an investor uses an unencrypted public Wi-Fi connection to place a trade, or if their personal device is compromised by keylogging malware, even the most secure backend infrastructure cannot prevent the compromise of the user’s session.
Regulatory Responses and Protective Measures
The IDX, in partnership with brokerage houses, is currently pushing for the universal adoption of Multi-Factor Authentication (MFA). MFA is considered the gold standard for preventing unauthorized access, as it requires not just a password, but a secondary verification step—such as a time-sensitive code sent to a registered device or biometric authentication.
"The exchange is doing its part in reinforcing the infrastructure, but the investor must be the first line of defense," Susandy stated. The IDX is currently urging brokerage firms to:
- Implement mandatory password rotation policies for all active accounts.
- Disable the ability to share login credentials between multiple users.
- Introduce real-time SMS or push-notification alerts for any login attempt or trade execution.
- Provide comprehensive security training for retail investors via webinars and educational materials.
The Broader Economic Implications
The erosion of trust is perhaps the most significant long-term risk posed by these security breaches. The Indonesian capital market has worked tirelessly over the past decade to demystify stock trading and attract a younger, tech-savvy generation of investors. If the perception takes hold that one’s life savings are not secure from digital theft, the resulting exodus of retail capital could have a cooling effect on market liquidity.
Furthermore, the market recently experienced a period of volatility, with the Jakarta Composite Index (IHSG) recording a weekly correction of 0.13% to settle at 5,050, resulting in a loss of approximately Rp119 trillion in market capitalization. While this market movement is driven by macroeconomic factors, the additional psychological burden of cyber-insecurity can exacerbate investor anxiety, potentially leading to panic selling or a retreat to safer, albeit less productive, asset classes.
The financial industry’s reputation is at stake. When an account is compromised, the legal and administrative process to recover funds or restore the status quo is often arduous and time-consuming. It involves coordination between the brokerage, the Central Securities Depository (KSEI), and potentially law enforcement agencies. This process can leave the affected investor in a state of financial limbo for weeks or even months.
Recommendations for Individual Investors
To mitigate these risks, industry experts suggest a multi-layered security approach:
- Unique Credentials: Never reuse passwords across different platforms. Use a reputable password manager to store complex, randomly generated credentials.
- Hardware and Network Hygiene: Avoid trading on public, unsecured Wi-Fi networks. Ensure that devices used for trading are protected by updated antivirus software and are not "jailbroken" or "rooted," which removes critical security protections.
- Device Management: If an investor loses a mobile phone or laptop, they should immediately contact their broker to suspend access to their account, regardless of whether they believe the device is secured by a passcode.
- Strict Access Control: Keep account credentials private. Treat the trading account as a sensitive banking entity. No legitimate financial professional will ever ask for an investor’s password or PIN.
Conclusion: A Shared Responsibility
The security of the Indonesian capital market is a shared responsibility between the regulator, the brokerage houses, and the individual investor. While the IDX continues to refine its technological defenses and mandate higher security standards for its members, the human factor remains the most significant variable in this equation.
As the financial landscape continues to evolve toward total digitization, the awareness and vigilance of the individual investor will define the resilience of the market. The events of 2025 and 2026 serve as a stark reminder that in the digital age, security is not a one-time setup, but a continuous process of adaptation and caution. As Irvan Susandy concluded, the goal is to create a digital environment where growth is supported by a foundation of trust and ironclad security. Failure to adapt to these new realities of cyber-threats will not only result in individual financial loss but will also undermine the broader objectives of the Indonesian capital market to serve as a reliable engine for national economic growth.
