ALPHV ransomware group lists Bakrie Group and Bakrie Sumatera Plantations

• Ransomware group: ALPHV
• Country: Indonesia
• Sector: Agriculture and Food Production
• Announcement date: November 7, 2023

ALPHV claims data breach at Bakrie Group and Bakrie Sumatera Plantations

The ALPHV ransomware group, also known as BlackCat, has claimed to have compromised data belonging to the Bakrie Group and its subsidiary, Bakrie Sumatera Plantations. The group has officially listed the Indonesian entities on its dedicated leak site, alleging a successful breach of their digital infrastructure.

Details of the alleged attack

According to the claims made by the ALPHV group, they gained unauthorized access to the servers belonging to both the Bakrie Group and Bakrie Sumatera Plantations on November 7, 2023. The group alleges that they successfully encrypted the data residing on these servers during the intrusion.

In addition to the encryption of systems, the threat actors stated that they exfiltrated relevant and important data from the organization. Following the exfiltration, the group provided a 48-hour deadline for the victim to establish contact. As part of their public announcement, the group published various document samples intended to demonstrate the nature of the stolen information, specifically focusing on documents related to the company's operational processes.

Data and information involved in the claim

The samples shared by the attackers in screenshots include various sensitive documents. These files appear to represent the internal administrative and financial operations of the targeted entities. The specific types of data identified in the announcement include:

• Financial records
• Purchase orders
• Accounting data

The presence of such files, including Excel documents containing accounting records and financial statements, highlights the potential sensitivity of the leaked information.

Organization profiles

The Bakrie Group is a large Indonesian conglomerate that was founded in 1942. The group maintains a diverse portfolio of interests across multiple sectors, including mining, energy, property, infrastructure, media, and telecommunications. Bakrie Sumatera Plantations operates as a subsidiary of the group, with its primary focus directed toward agriculture and the production of vegetable oil.

Impact assessment and industry implications

The claims made by ALPHV could have significant consequences for the affected organizations. If the claims are accurate, the breach may negatively impact the operational continuity of the institutions and could lead to the disclosure of highly sensitive trade secrets. Furthermore, the exposure of financial data poses secondary risks, such as the potential for identity theft or the execution of targeted phishing attacks against employees and business partners.

From a regulatory perspective, the institution may face legal obligations under the data protection regulations established in Indonesia. The ALPHV group is known for utilizing malware developed in the Rust programming language and frequently employs double extortion methods. Double extortion is a tactic where attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to pressure the victim into paying the ransom. This method significantly increases the risk of reputational damage if the data is subsequently published.

Publicly available information regarding the ALPHV group indicates that the group emerged in late 2021 and reportedly ceased operations as of 2024. For organizations in the agriculture and food production sectors, maintaining robust cybersecurity posture is essential to protect against such threats. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to mitigate the risk of unauthorized server access and data exfiltration.