Indonesia Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Indonesia
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Indonesia, checked 7 Nov 2026. BSSN issues security advisories and statements; Komdigi handles personal data protection reports.
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
| Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| BSSN traffic anomalies recorded in 2025 | 5.5 billion | 2025 | detikInet (BSSN Deputy Bondan Widiawan, 23 Apr 2026) |
| BSSN traffic anomalies in early 2026 | 1.5 billion (1.52 billion per Kompas) | 1 Jan to 15 Apr 2026 | detikInet |
| Rise in 2025 attacks over the 2020 to 2024 annual average | 714 percent | 2025 | Kompas (BSSN, 23 Apr 2026) |
| BSSN incident notifications sent in 2026 (and responded to) | 1,002 (776 responded) | 1 Jan to about 23 Apr 2026 | detikInet |
| BSSN incident notifications sent in 2025 (and responded to) | 2,855 (about 2,186 responded) | 2025 | detikInet |
| Registered government cyber incident response teams (TTIS) | 514 | as of 6 Oct 2026 | Rilis Kalimantan (BSSN Deputy Sulistyo) |
| Scam reports received by IASC | 737,686 | 22 Nov 2024 to 28 Oct 2026 | ANTARA (OJK, 5 Nov 2026) |
| Scam-linked funds blocked by IASC | Rp967.5 billion | 22 Nov 2024 to 28 Oct 2026 | ANTARA (OJK, 5 Nov 2026) |
| Accounts reported to IASC and blocked | 1,471,112 reported, 743,589 blocked | 22 Nov 2024 to 28 Oct 2026 | ANTARA (OJK, 5 Nov 2026) |
| Scam victim funds returned via IASC | Rp208.9 billion | 22 Nov 2024 to 28 Oct 2026 | ANTARA (OJK, 5 Nov 2026) |
| Scam reports received by IASC (mid-year checkpoint) | 637,055 | 22 Nov 2024 to 31 Jul 2026 | Kompas (Satgas PASTI, 1 Sep 2026) |
| Online gambling sites and content taken down by Komdigi | 3.7 million | 20 Oct 2024 to 12 Jul 2026 | detikInet (Minister Meutya Hafid, 14 Jul 2026) |
| Phone numbers reported to Komdigi as used for scams | about 85,500 | period not stated (reported 14 Jul 2026) | detikInet |
| Accounts reported via cekrekening.id for gambling or fraud | more than 156,000 | period not stated (reported 14 Jul 2026) | detikInet |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| The Gentlemen | Ransomware | Listed Garuda Indonesia, Equity Life, Pertamina, Solaria and WIKA Beton on its leak site between February and October 2026. | ransomware.live · ransomware.live | Profile |
| Nova | Ransomware | Listed at least nine Indonesian victims in 2026, mostly public bodies, including Bojonegoro regency, Badan Pangan Nasional, BPOM Bandung, the transport ministry and RSUI. | ransomware.live · ransomware.live | Profile |
| CoinbaseCartel | Extortion | Data-extortion listings against KemenPPPA, the agriculture ministry, BPR Bintan, Jamu Air Mancur and others in 2026. | ransomware.live · ransomware.live | Profile |
| Everest | Ransomware | Claimed the customs analytics platform and BUMN contractor Brantas Abipraya in March and April 2026. | ransomware.live · ransomware.live | Profile |
| Panzer | Ransomware | Listed Frisian Flag, Universitas Surakarta and the Central Java Diskominfo between August and September 2026. | ransomware.live | Profile |
| LockBit 5.0 | Ransomware | Listed Energi Mega Persada, Murni Solusindo, JEC Eye Hospitals and Synergy in 2026. | ransomware.live · ransomware.live | Profile |
| RansomHouse | Extortion | Listed Star Energy Geothermal Salak in April 2026 in addition to its later energy-sector claims. | ransomware.live | Profile |
| Tengu | Ransomware | Listed KSP TLM Indonesia, Jakarta Nanyang School and Mitra Antar Tangguh in January and February 2026. | ransomware.live | |
| WorldLeaks | Extortion | Listed IT firm Intikom and BMJ Paperpack in April and May 2026. | ransomware.live | Profile |
| DYSPHOR1A | Unattributed | Claimed a database of about 52,000 Indonesian police officers in August 2026. | ransomware.live | Profile |
| TripleX | Unattributed | Listed bni.co.id customer data in June 2026, which BNI says it found no evidence of. | ransomware.live | |
| B4d0kAhay | Unattributed | Posted a sample of North Kalimantan civil servant data that BSSN judged valid in June 2026. | detikKalimantan | |
| Online gambling SEO access sellers | Scam syndicate | Police arrested a Demak man who sold hacked school, campus and government site access to gambling promoters; Badung sites were defaced with gambling ads in August. | Kompas · Bali Tribune |
Laws and rules this year
- 5 Nov 2026Komdigi Kepmen 127 and 128 of 2026 on urgent content takedown. Platforms must take down urgent content such as online gambling within four hours of a Komdigi takedown order (date is the report date; the decree dates were not stated). Source
- 16 Jul 2026PP 33/2026 implementing the PDP Law. President Prabowo signed the implementing regulation for the PDP Law covering consent, children's data and data subject rights; it takes effect on 16 January 2027. Source
- 29 Jun 2026DPR and government form working committee on the Cyber Security and Resilience Bill (RUU KKS). Commission I and the government set up a 23-member panja chaired by Sukamta to deliberate the bill, which covers critical information infrastructure duties, post-incident audits, sanctions and criminal provisions. Source
- 20 May 2026Draft Perpres on the personal data protection agency sent to the President. Komdigi told the Constitutional Court on 27 July that the draft Perpres creating the PDP agency was sent for enactment on 20 May and is not yet signed; Komdigi handles PDP oversight until then. Source
- 20 May 2026Revision of the PDP Law added to the 2026 Prolegnas priority list. The DPR plenary listed a revision of Law 27/2022 among 68 priority bills for 2026; drafting had not started at the time. Source
- 23 Jan 2026PADK OJK No. 1 of 2026 on IT implementation by commercial banks. Sets IT risk and security controls for banks from 1 March 2026, with 24-hour notice to OJK for significant non-cyber IT incidents and a full report within five business days. Source
Full stories
Official statements
- 5 Nov 2026OJK reports 737,686 IASC scam reports and Rp967.5 billion in blocked funds as of 28 October. ANTARA
- 24 Oct 2026The Ministry of Industry takes some websites and systems offline as a PHP2Shell mitigation. Bisnis
- 23 Oct 2026BSSN warns PHP2Shell flaws let attackers take over servers and urges patching or isolating exposed PHP systems. Katadata
- 23 Oct 2026Komdigi tells users of national data centre PDN-1 and government cloud to update PHP against PHP2Shell. Bisnis
- 6 Oct 2026BSSN inaugurates 59 new incident response teams, bringing registered TTIS to 514. Rilis Kalimantan
- 5 Oct 2026BSSN says personal data circulating online, including the Komdigi minister's, came from old leaks and open sources, not a new breach. CNN Indonesia
- 1 Sep 2026Satgas PASTI reports 637,055 IASC scam reports and Rp724.1 billion blocked as of 31 July. Kompas
- 9 Aug 2026Diskominfo Badung confirms two defaced subdomain sites and takes them down. Bali Tribune
- 30 Jul 2026Polda Jatim announces the arrest of a hacker who sold access to 260 hacked Indonesian websites for gambling promotion. Kompas
- 27 Jul 2026Komdigi tells the Constitutional Court the PDP agency Perpres awaits presidential enactment. Kompas
- 14 Jul 2026Minister Meutya Hafid says Komdigi took down 3.7 million gambling sites and content items between October 2024 and July 2026. detikInet
- 29 Jun 2026The government and DPR Commission I form a working committee on the Cyber Security and Resilience Bill. ANTARA
- 24 Jun 2026BSSN notifies North Kalimantan of a valid leak sample from its Simpeg civil service system. detikKalimantan
- 22 May 2026BNI says it found no sign of unauthorised taking or transfer of customer data. Kompas
- 21 May 2026BCA says an internal investigation found no customer data leak after a dark web listing claimed 4.9 million records. Kompas
- 23 Apr 2026BSSN Deputy Bondan Widiawan reports 5.5 billion traffic anomalies in 2025 and 1.5 billion from 1 January to 15 April 2026. detikInet
- 7 Apr 2026Bandung Diskominfo denies that a claimed one-million-record dataset came from the city's civil registry server. Merdeka
- 4 Feb 2026Komdigi Secretary General Ismail tells the DPR that exposed job applicant files are being handled internally. CNN Indonesia
- 22 Jan 2026Deputy Minister Nezar Patria says the university data leak may stem from the higher education ministry's data centre and asks ministries to review CSIRT readiness. CNBC Indonesia
- 19 Jan 2026Kemdiktisaintek says it is still verifying claims that student and lecturer data from a dozen-plus universities is on sale. Kompas
- 16 Jan 2026Komdigi says it summoned Meta over a reported Instagram data leak and relays Meta's view that no passwords were exposed. CNN Indonesia
Incidents
43 of 43 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedFore Coffee | 5 Nov 2026 | Retail | Data leak | None | Confirmed. Fore reported unauthorised access to customer data to Komdigi on 28 Oct; Komdigi puts it at about 5.7 million customer accounts. | CNBC Indonesia · Investortrust✓ 7 Nov |
 ⚠️ ClaimedBank Mandiri | 5 Nov 2026 | Finance | Data leak | None | Claimed. A dark web forum seller posted a sample and offered a 2026 database of Mandiri debit card users with names, phones, emails, card and account details and limits. | Harian Massa✓ 7 Nov |
 ⚠️ ClaimedDirectorate General of Taxes (DJP) | 31 Oct 2026 | Government | Access for sale | Claimed. A crime-forum seller offers a 0-day exploit and more than 10 million taxpayer records allegedly from DJP. No DJP response found. | VECERT✓ 7 Nov | |
 ⚠️ ClaimedWIKA Beton (PT Wijaya Karya Beton Tbk, BUMN group) | 31 Oct 2026 | Manufacturing | Ransomware | Claimed. The Gentlemen listed the state-group precast concrete maker with an estimated attack date of 26 October; no data volume was stated. | ransomware.live · Dark Web Intelligence on X✓ 7 Nov | |
 ⚠️ ClaimedILCS Pelindo | 12 Oct 2026 | Transport | Ransomware | Claimed. Pelindo's port logistics IT unit is listed on N0n's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSupreme Energy | 9 Oct 2026 | Energy | Ransomware | Claimed. The geothermal developer is listed on Panzer's leak site. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedKomdigi minister's personal data | 3 Oct 2026 | Government | Data leak | None | Confirmed. The minister's personal data circulated online; Komdigi and BSSN say it came from old leaks and opened a probe into illegal data trading with police. | Okezone · Kompas✓ 7 Nov |
| ⚠️ ClaimedIndo Tambangraya Megah | 2 Oct 2026 | Energy | Ransomware | Claimed. The coal producer is listed on RansomHouse's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedSolaria restaurant chain | 30 Sep 2026 | Retail | Ransomware | Claimed. The Gentlemen listed the Solaria restaurant chain with an estimated attack date of 29 September. | ransomware.live✓ 7 Nov | |
| 🚫 DisputedDJP Coretax | 21 Sep 2026 | Government | Data leak | None | Response. DJP denied the leak, saying the data had fields it never stores and plaintext passwords. Claimed. A dark-web monitoring account claimed taxpayer data with passwords and tokens was stolen. | CNN Indonesia · CNBC Indonesia✓ 7 Nov |
 ⚠️ ClaimedPertamina | 17 Sep 2026 | Energy | Ransomware | Claimed. Listed on RansomHouse's leak site; Pertamina has not confirmed it. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedDiskominfo Provinsi Jawa Tengah | 3 Sep 2026 | Government | Ransomware | Claimed. Panzer listed the Central Java communications and informatics office on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSinar Mas Agribusiness and Food (Golden Agri-Resources) | 25 Aug 2026 | Manufacturing | Data leak | Claimed. ShadowByt3$ claimed it breached the company months earlier and posted 375.66 MB of data. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedPT Bank Perekonomian Rakyat Bintan | 22 Aug 2026 | Finance | Ransomware | Claimed. CoinbaseCartel listed the rural bank on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedKepolisian Negara Republik Indonesia (Polri) personnel database | 20 Aug 2026 | Government | Data leak | Claimed. DYSPHOR1A claimed a database of about 52,000 police officers with emails and phone numbers. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedFrisian Flag Indonesia | 20 Aug 2026 | Manufacturing | Ransomware | Claimed. Panzer listed the dairy maker on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedPemkab Badung (Museum Yadnya and Desa Ayunan sites) | 9 Aug 2026 | Government | Defacement | None | Confirmed. Diskominfo Badung e-government head I Gusti Agung Angga Mulyanta confirmed on 9 August that two subdomain sites showed abortion drug and online gambling ads and were taken down. | Bali Tribune✓ 7 Nov |
 ⚠️ ClaimedPusat Hidro-Oseanografi TNI AL (Pushidrosal) | 4 Aug 2026 | Government | Ransomware | Claimed. INC Ransom listed pushidrosal.id, the navy hydro-oceanographic centre, on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedPertamina | 31 Jul 2026 | Energy | Ransomware | Claimed. The Gentlemen claimed more than 1.2 TB of Pertamina data including HR records, technical drawings, SCADA documents and bank statements; this listing is separate from the later RansomHouse claim. | ransomware.live · cybersecurity.or.id✓ 7 Nov | |
| ✅ Confirmed260 Indonesian school, university and government websites | 30 Jul 2026 | Education | SEO poisoning | Confirmed. Polda Jatim cyber director Kombes Bimo Ariyanto said police arrested a Demak man, AAK, who hacked 80 school, 20 university, 13 government and 147 private Indonesian sites since 2023 and sold access to promote online gambling. | Kompas · detikJatim✓ 7 Nov | |
| ⚠️ ClaimedRumah Sakit Universitas Indonesia (RSUI) | 20 Jul 2026 | Health | Ransomware | Claimed. Nova listed the University of Indonesia teaching hospital on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedKementerian Perhubungan (Directorate General of Sea Transportation) | 19 Jul 2026 | Transport | Ransomware | Claimed. Nova listed the transport ministry's shipping and maritime directorate and threatened to leak maritime data. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedPemprov Kalimantan Utara (Simpeg civil service system) | 22 Jun 2026 | Government | Data leak | Confirmed. BSSN notified the province of a leak indication found on 22 June and judged the posted sample valid after matching names and phone numbers; the provincial DKISP confirmed the notice and ordered password changes. Claimed. An actor called B4d0kAhay posted a sample of civil servant names, NIP numbers and positions on a darknet forum, reportedly using infostealer-harvested credentials. | detikKalimantan✓ 7 Nov | |
 ⚠️ ClaimedBalai Besar POM di Bandung | 14 Jun 2026 | Health | Ransomware | Claimed. Nova listed the Bandung office of the food and drug regulator on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedJEC Eye Hospitals and Clinics | 11 Jun 2026 | Health | Ransomware | Claimed. LockBit 5.0 listed the eye hospital group with an estimated attack date of 19 April. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedBadan Pangan Nasional | 29 May 2026 | Government | Ransomware | Claimed. Nova listed the national food agency on its leak site. | ransomware.live✓ 7 Nov | |
 🚫 DisputedBank Negara Indonesia (BNI) | 22 May 2026 | Finance | Data leak | Response. BNI Corporate Secretary Okki Rushartomo said on 22 May that the bank found no sign of unauthorised taking or transfer of customer data and services were running normally. Claimed. A social media post claimed customer data was for sale; ransomware.live later logged a TripleX listing for bni.co.id on 13 June with an estimated attack date of 11 May. | Kompas · ransomware.live✓ 7 Nov | |
 🚫 DisputedBank Central Asia (BCA) | 21 May 2026 | Finance | Access for sale | None | Response. BCA EVP Corporate Communication Hera F. Haryn said an internal investigation found no match between the circulating data and BCA's database and no customer data leaked. Claimed. A dark web seller offered a dataset called BCA Mobile Bank Access & Database, claiming about 890,000 accesses and 4.9 million records. | Kompas✓ 7 Nov |
 ⚠️ ClaimedBapenda Kabupaten Jombang | 28 Apr 2026 | Government | Data leak | None | Claimed. A threat actor claimed about 100,000 taxpayer and service-request records (2025 to 2026) from the Jombang regional revenue agency website. | Dark Web Intelligence on X · Jawa Pos Jombang · Melekmedia✓ 7 Nov |
 ⚠️ ClaimedDirektorat Jenderal Bea dan Cukai (customs analytics platform) | 28 Apr 2026 | Government | Ransomware | Claimed. Everest claimed about 44.86 GB in 437 files from a customs analytics system, including Power BI audit models and about 173,292 corporate tax ID records, with a short publication deadline. | ransomware.live · Reskrim Polda News✓ 7 Nov | |
 ⚠️ ClaimedStar Energy Geothermal Salak | 24 Apr 2026 | Energy | Ransomware | Claimed. RansomHouse listed the geothermal operator with an estimated attack date of 11 April. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedKementerian Pertanian | 23 Apr 2026 | Government | Data leak | Claimed. CoinbaseCartel listed the Ministry of Agriculture on its leak site; no leak size was given. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedKementerian Pemberdayaan Perempuan dan Perlindungan Anak (KemenPPPA) | 15 Apr 2026 | Government | Ransomware | Claimed. CoinbaseCartel listed the women's empowerment and child protection ministry on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPemerintah Kabupaten Bojonegoro | 5 Apr 2026 | Government | Ransomware | Claimed. Nova listed the Bojonegoro regency government on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedEquity Life Indonesia | 4 Apr 2026 | Finance | Ransomware | Claimed. The Gentlemen listed the life insurer on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPT Brantas Abipraya (BUMN) | 31 Mar 2026 | Property | Ransomware | Claimed. Everest listed the state-owned construction company on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPT Energi Mega Persada Tbk | 30 Mar 2026 | Energy | Ransomware | Claimed. LockBit 5.0 listed the upstream oil and gas company with an estimated attack date of 26 February. | ransomware.live✓ 7 Nov | |
| 🚫 DisputedBandung city population data | 26 Mar 2026 | Government | Data leak | Response. Bandung Diskominfo head Henryco Arie Sapiie said on 7 April that the data did not come from the Disdukcapil server and did not match the SIAK format, after checks coordinated with BSSN. Claimed. An actor called petrusnism claimed a database of more than one million Bandung residents' records. | Merdeka✓ 7 Nov | |
 ⚠️ ClaimedGaruda Indonesia | 21 Feb 2026 | Transport | Ransomware | Claimed. The Gentlemen listed the state airline on its leak site; the tracker estimates the attack date as July 2023. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPT Darma Henwa Tbk | 16 Feb 2026 | Energy | Ransomware | Claimed. Spacebears listed the mining contractor on its leak site with an estimated attack date of 15 February. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedKomdigi (job applicant recruitment) | 4 Feb 2026 | Government | Data leak | None | Confirmed. Komdigi Secretary General Ismail told a DPR Commission I hearing on 4 February that the exposed applicant files were being handled internally and that the Inspector General was reviewing procedures. | CNN Indonesia · CNN Indonesia✓ 7 Nov |
| ⚠️ ClaimedKemdiktisaintek and a dozen-plus universities | 19 Jan 2026 | Education | Data leak | None | Response. Kemdiktisaintek Secretary General Togar Mangihut Simatupang said the ministry was still tracing and verifying the data and that some of it appeared old; Deputy Minister Nezar Patria said the leak may have come from the ministry's data centre. Claimed. Screenshots shared on Facebook claimed student and lecturer data (names, NIM, emails, passwords) from more than a dozen universities was being sold on a dark web forum. | Kompas · CNBC Indonesia✓ 7 Nov |
| 🚫 DisputedInstagram (Meta) users in Indonesia | 14 Jan 2026 | Media | Data leak | None | Response. Komdigi summoned Meta on 14 January and relayed Meta's position that no passwords were exposed and no misuse of the password reset feature was found, with Meta's investigation still ongoing. Claimed. A third-party report claimed a leak of Instagram user data linked to a wave of password reset emails. | CNN Indonesia · Kompas Tekno✓ 7 Nov |
FAQ
Does Indonesia have a national cyber threat level?
No published national cyber threat level was found for Indonesia (checked 7 Nov 2026). BSSN issues security advisories and statements; Komdigi handles personal data protection reports.
Which organisations in Indonesia confirmed cyber incidents recently?
6 incidents confirmed since January 2026: Fore Coffee, Komdigi minister's personal data, Pemkab Badung (Museum Yadnya and Desa Ayunan sites), 260 Indonesian school, university and government websites, Pemprov Kalimantan Utara (Simpeg civil service system) and Komdigi (job applicant recruitment).
Which Indonesia organisations appear on ransomware or leak sites?
37 claims, not confirmed by the organisations: Bank Mandiri, Directorate General of Taxes (DJP), WIKA Beton (PT Wijaya Karya Beton Tbk, BUMN group), ILCS Pelindo, Supreme Energy, Indo Tambangraya Megah, Solaria restaurant chain and DJP Coretax and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.