https://pwnsy.com/tools/cyber-watch/indonesia/Sourced cyber incidents and official statements, from pwnsy Cyber Watch.enSun, 08 Nov 2026 00:00:00 +0000https://pwnsy.com/tools/cyber-watch/indonesia/#allce11d641f0afc69fThu, 05 Nov 2026 00:00:00 +0000Fore reported unauthorised access to customer data to Komdigi on 28 Oct; Komdigi puts it at about 5.7 million customer accounts. Sources: https://www.cnbcindonesia.com/tech/20261105084917-37-782483/fore-lapor-data-pelanggan-bocor-ke-komdigi-begini-sanksinya, https://investortrust.id/business/121838/data-fore-coffee-diduga-bocor-kemenkomdigi-bakal-kasih-sanksihttps://pwnsy.com/tools/cyber-watch/indonesia/#allb558b9ee7569c97cThu, 05 Nov 2026 00:00:00 +0000A dark web forum seller posted a sample and offered a 2026 database of Mandiri debit card users with names, phones, emails, card and account details and limits. Sources: https://harianmassa.id/ototekno/2717861940/nasabah-bank-mandiri-hati-hati-data-kartu-debit-bocor-di-dark-webhttps://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan38c0fa872e4a693bThu, 05 Nov 2026 00:00:00 +0000OJK reports 737,686 IASC scam reports and Rp967.5 billion in blocked funds as of 28 October.https://pwnsy.com/tools/cyber-watch/indonesia/#all5d952c5875c84eadSat, 31 Oct 2026 00:00:00 +0000A crime-forum seller offers a 0-day exploit and more than 10 million taxpayer records allegedly from DJP. No DJP response found. Sources: https://x.com/VECERTRadar/status/2116551923146846504https://pwnsy.com/tools/cyber-watch/indonesia/#all093efe91f3100cd0Sat, 31 Oct 2026 00:00:00 +0000The Gentlemen listed the state-group precast concrete maker with an estimated attack date of 26 October; no data volume was stated. Sources: https://www.ransomware.live/id/V0lLQSBCZXRvbkB0aGVnZW50bGVtZW4, https://x.com/DailyDarkWeb/status/2114740361176236435https://teknologi.bisnis.com/read/20261024/101/2015333/kemenperin-matikan-situs-sementara-gegara-kerentanan-php2shelldcf7a79ff6d0baaaSat, 24 Oct 2026 00:00:00 +0000The Ministry of Industry takes some websites and systems offline as a PHP2Shell mitigation.https://katadata.co.id/digital/teknologi/6ada569d0383f/bssn-beri-peringatan-soal-celah-php-server-berisiko-diambil-alih-hackerff5deee3795db0afFri, 23 Oct 2026 00:00:00 +0000BSSN warns PHP2Shell flaws let attackers take over servers and urges patching or isolating exposed PHP systems.https://teknologi.bisnis.com/read/20261023/101/2015094/komdigi-peringatkan-ancaman-kerentanan-php2shell-minta-pengguna-pdn-1-update-phpab201a60cc08159dFri, 23 Oct 2026 00:00:00 +0000Komdigi tells users of national data centre PDN-1 and government cloud to update PHP against PHP2Shell.https://pwnsy.com/tools/cyber-watch/indonesia/#alle8061b574a884f69Mon, 12 Oct 2026 00:00:00 +0000Pelindo's port logistics IT unit is listed on N0n's leak site. Sources: https://www.ransomware.live/id/SUxDUyBQZWxpbmRvIChwb3J0IGxvZ2lzdGljcyBvcGVyYXRpb25zKUBOMG4https://pwnsy.com/tools/cyber-watch/indonesia/#all1995ef2caa067e8bFri, 09 Oct 2026 00:00:00 +0000The geothermal developer is listed on Panzer's leak site. Sources: https://www.ransomware.live/id/U3VwcmVtZSBFbmVyZ3lAUGFuemVyhttps://www.riliskalimantan.com/2026/10/bssn-kukuhkan-59-tim-tanggap-insiden.htmlaef742b25cd4e30dTue, 06 Oct 2026 00:00:00 +0000BSSN inaugurates 59 new incident response teams, bringing registered TTIS to 514.https://www.cnnindonesia.com/teknologi/20261005143246-185-1411797/bssn-sebut-ramai-data-beredar-di-internet-bukan-kebocoran-baru4070fd2b98c5df12Mon, 05 Oct 2026 00:00:00 +0000BSSN says personal data circulating online, including the Komdigi minister's, came from old leaks and open sources, not a new breach.https://pwnsy.com/tools/cyber-watch/indonesia/#all20b904f4cb750a41Sat, 03 Oct 2026 00:00:00 +0000The minister's personal data circulated online; Komdigi and BSSN say it came from old leaks and opened a probe into illegal data trading with police. Sources: https://news.okezone.com/read/2026/10/03/337/3245769/sebut-data-menkomdigi-yang-beredar-data-lama-komdigi-gandeng-bssn-usut-jual-beli-data-pribadi, https://nasional.kompas.com/read/2026/10/06/17570791/data-pribadi-menkomdigi-diduga-bocor-bssn-lakukan-penelusuranhttps://pwnsy.com/tools/cyber-watch/indonesia/#all532488ec811862f8Fri, 02 Oct 2026 00:00:00 +0000The coal producer is listed on RansomHouse's leak site. Sources: https://www.ransomware.live/id/UFQgSW5kbyBUYW1iYW5ncmF5YSBNZWdhaEByYW5zb21ob3VzZQhttps://pwnsy.com/tools/cyber-watch/indonesia/#all0ba6e11bc24163b7Wed, 30 Sep 2026 00:00:00 +0000The Gentlemen listed the Solaria restaurant chain with an estimated attack date of 29 September. Sources: https://www.ransomware.live/id/U29sYXJpYUB0aGVnZW50bGVtZW4https://pwnsy.com/tools/cyber-watch/indonesia/#allb0f17c4ffe57eaecMon, 21 Sep 2026 00:00:00 +0000DJP denied the leak, saying the data had fields it never stores and plaintext passwords. A dark-web monitoring account claimed taxpayer data with passwords and tokens was stolen. Sources: https://www.cnnindonesia.com/ekonomi/20260921114415-532-1406253/djp-kemenkeu-buka-suara-soal-kabar-data-pajak-bocor, https://www.cnbcindonesia.com/news/20260921110739-4-769485/ditjen-pajak-bantah-data-coretax-bocorhttps://pwnsy.com/tools/cyber-watch/indonesia/#all8fd7108844ffb5eeThu, 17 Sep 2026 00:00:00 +0000Listed on RansomHouse's leak site; Pertamina has not confirmed it. Sources: https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNlhttps://pwnsy.com/tools/cyber-watch/indonesia/#all9473f9100ebf4848Thu, 03 Sep 2026 00:00:00 +0000Panzer listed the Central Java communications and informatics office on its leak site. Sources: https://www.ransomware.live/id/RGluYXMgS29tdW5pa2FzaSBkYW4gSW5mb3JtYXRpa2FAUGFuemVyhttps://money.kompas.com/read/2026/09/02/054000426/iasc-ojk-terima-laporan-1-17-juta-rekening-terkait-scam-dana-rp-724-miliar4acd8ac59ad66f27Tue, 01 Sep 2026 00:00:00 +0000Satgas PASTI reports 637,055 IASC scam reports and Rp724.1 billion blocked as of 31 July.https://pwnsy.com/tools/cyber-watch/indonesia/#allbbe34cde151652a6Tue, 25 Aug 2026 00:00:00 +0000ShadowByt3$ claimed it breached the company months earlier and posted 375.66 MB of data. Sources: https://www.ransomware.live/id/U2luYXIgTWFzIEFncmlidXNpbmVzcyBhbmQgRm9vZCBHb2xkZW4gQWdyaS1SZXNvdXJjZXMpQFNoYWRvd0J5dDMkhttps://pwnsy.com/tools/cyber-watch/indonesia/#allf0794ae42d39b656Sat, 22 Aug 2026 00:00:00 +0000CoinbaseCartel listed the rural bank on its leak site. Sources: https://www.ransomware.live/id/UFQuIEJhbmsgUGVyZWtvbm9taWFuIFJha3lhdCBCaW50YW5AY29pbmJhc2VjYXJ0ZWwhttps://pwnsy.com/tools/cyber-watch/indonesia/#alla051d374db97d686Thu, 20 Aug 2026 00:00:00 +0000DYSPHOR1A claimed a database of about 52,000 police officers with emails and phone numbers. Sources: https://www.ransomware.live/id/SW5kb25lc2lhbiBQb2xpY2UgRGF0YWJhc2VARFlTUEhPUjFBhttps://pwnsy.com/tools/cyber-watch/indonesia/#all6295791272bf2777Thu, 20 Aug 2026 00:00:00 +0000Panzer listed the dairy maker on its leak site. Sources: https://www.ransomware.live/id/RnJpc2lhbiBGbGFnIEluZG9uZXNpYUBQYW56ZXIhttps://pwnsy.com/tools/cyber-watch/indonesia/#all025c5c22aa6ef370Sun, 09 Aug 2026 00:00:00 +0000Diskominfo Badung e-government head I Gusti Agung Angga Mulyanta confirmed on 9 August that two subdomain sites showed abortion drug and online gambling ads and were taken down. Sources: https://balitribune.co.id/content/dua-website-pemkab-badung-diretas-sempat-muncul-iklan-obat-aborsi-dan-judi-onlinehttps://balitribune.co.id/content/dua-website-pemkab-badung-diretas-sempat-muncul-iklan-obat-aborsi-dan-judi-online3835815c60406f89Sun, 09 Aug 2026 00:00:00 +0000Diskominfo Badung confirms two defaced subdomain sites and takes them down.https://pwnsy.com/tools/cyber-watch/indonesia/#allb9747035ea848619Tue, 04 Aug 2026 00:00:00 +0000INC Ransom listed pushidrosal.id, the navy hydro-oceanographic centre, on its leak site. Sources: https://www.ransomware.live/id/cHVzaGlkcm9zYWwuaWRAaW5jcmFuc29thttps://pwnsy.com/tools/cyber-watch/indonesia/#all0aff79dae9420ddbFri, 31 Jul 2026 00:00:00 +0000The Gentlemen claimed more than 1.2 TB of Pertamina data including HR records, technical drawings, SCADA documents and bank statements; this listing is separate from the later RansomHouse claim. Sources: https://www.ransomware.live/id/UGVydGFtaW5hQHRoZWdlbnRsZW1lbg, https://www.cybersecurity.or.id/2026/08/dugaan-kebocoran-12-tb-data-pertamina.htmlhttps://pwnsy.com/tools/cyber-watch/indonesia/#all3d5e8ce80f0626fbThu, 30 Jul 2026 00:00:00 +0000Polda Jatim cyber director Kombes Bimo Ariyanto said police arrested a Demak man, AAK, who hacked 80 school, 20 university, 13 government and 147 private Indonesian sites since 2023 and sold access to promote online gambling. Sources: https://surabaya.kompas.com/read/2026/07/31/055009678/hacker-demak-retas-website-sekolah-hingga-pemda-belajar-otodidak-dari-grup, https://www.detik.com/jatim/hukum-dan-kriminal/d-8596821/hacker-di-jatim-jual-web-sekolah-pemerintah-buat-promosi-judi-onlinehttps://surabaya.kompas.com/read/2026/07/31/055009678/hacker-demak-retas-website-sekolah-hingga-pemda-belajar-otodidak-dari-grupeba48f95fe91abe4Thu, 30 Jul 2026 00:00:00 +0000Polda Jatim announces the arrest of a hacker who sold access to 260 hacked Indonesian websites for gambling promotion.https://nasional.kompas.com/read/2026/07/27/15423511/komdigi-ungkap-perpres-pembentukan-badan-perlindungan-data-pribadi-sedang17ec3202d0097792Mon, 27 Jul 2026 00:00:00 +0000Komdigi tells the Constitutional Court the PDP agency Perpres awaits presidential enactment.https://pwnsy.com/tools/cyber-watch/indonesia/#all5fa97d4d7d2127d2Mon, 20 Jul 2026 00:00:00 +0000Nova listed the University of Indonesia teaching hospital on its leak site. Sources: https://www.ransomware.live/id/UnVtYWggU2FraXQgVW5pdmVyc2l0YXMgSW5kb25lc2lhIChSU1VJKUBub3Zhhttps://pwnsy.com/tools/cyber-watch/indonesia/#all651cfee96e39b367Sun, 19 Jul 2026 00:00:00 +0000Nova listed the transport ministry's shipping and maritime directorate and threatened to leak maritime data. Sources: https://www.ransomware.live/id/RGVwaHViQG5vdmEhttps://inet.detik.com/law-and-policy/d-8573944/komdigi-tutup-3-7-juta-konten-judi-online-sejak-oktober-2024550ca8ce28594e08Tue, 14 Jul 2026 00:00:00 +0000Minister Meutya Hafid says Komdigi took down 3.7 million gambling sites and content items between October 2024 and July 2026.https://www.antaranews.com/berita/5626912/pemerintah-dan-dpr-bentuk-panja-ruu-keamanan-dan-ketahanan-siber7b9bce18a125b8d1Mon, 29 Jun 2026 00:00:00 +0000The government and DPR Commission I form a working committee on the Cyber Security and Resilience Bill.https://www.detik.com/kalimantan/berita/d-8549558/bssn-temukan-indikasi-kebocoran-data-dalam-aplikasi-simpeg-pemprov-kaltara0f33da99d77a4bc7Wed, 24 Jun 2026 00:00:00 +0000BSSN notifies North Kalimantan of a valid leak sample from its Simpeg civil service system.https://pwnsy.com/tools/cyber-watch/indonesia/#all5600c4619bc8e871Mon, 22 Jun 2026 00:00:00 +0000BSSN notified the province of a leak indication found on 22 June and judged the posted sample valid after matching names and phone numbers; the provincial DKISP confirmed the notice and ordered password changes. An actor called B4d0kAhay posted a sample of civil servant names, NIP numbers and positions on a darknet forum, reportedly using infostealer-harvested credentials. Sources: https://www.detik.com/kalimantan/berita/d-8549558/bssn-temukan-indikasi-kebocoran-data-dalam-aplikasi-simpeg-pemprov-kaltarahttps://pwnsy.com/tools/cyber-watch/indonesia/#all4048c4bdbc204a74Sun, 14 Jun 2026 00:00:00 +0000Nova listed the Bandung office of the food and drug regulator on its leak site. Sources: https://www.ransomware.live/id/QmFuZHVuZ0Bub3Zhhttps://pwnsy.com/tools/cyber-watch/indonesia/#all35976025d8520876Thu, 11 Jun 2026 00:00:00 +0000LockBit 5.0 listed the eye hospital group with an estimated attack date of 19 April. Sources: https://www.ransomware.live/id/amVjLmNvLmlkQGxvY2tiaXQ1https://pwnsy.com/tools/cyber-watch/indonesia/#allcf8f6be38a290114Fri, 29 May 2026 00:00:00 +0000Nova listed the national food agency on its leak site. Sources: https://www.ransomware.live/id/QmFkYW4gUGFuZ2FuIE5hc2lvbmFsQG5vdmEhttps://pwnsy.com/tools/cyber-watch/indonesia/#all8b3ac1becad70969Fri, 22 May 2026 00:00:00 +0000BNI Corporate Secretary Okki Rushartomo said on 22 May that the bank found no sign of unauthorised taking or transfer of customer data and services were running normally. A social media post claimed customer data was for sale; ransomware.live later logged a TripleX listing for bni.co.id on 13 June with an estimated attack date of 11 May. Sources: https://money.kompas.com/read/2026/05/23/060800226/isu-kebocoran-data-nasabah-bni--kami-tidak-temukan-itu-, https://www.ransomware.live/id/Qm5pLmNvLmlkIGJhbmsgb2YgaW5kb25lc2lhIGZyZWUgZGF0YS5AVHJpcGxlIFg