Babuk2 claims data breach against MYINDIHOME TELKOM INDONESIA

• Ransomware group: Babuk2
• Country: Indonesia
• Sector: Technology
• Announcement date: January 28, 2025

Babuk2 claims data breach against MYINDIHOME TELKOM INDONESIA

The Babuk2 ransomware group has published an announcement on its dedicated leak site, claiming to have compromised data belonging to MYINDIHOME TELKOM INDONESIA. This development follows a pattern often seen in modern cyberattacks where threat actors utilize leak sites to pressure organizations by threatening to release sensitive information to the public.

Details of the alleged attack

According to the announcement made on January 28, 2025, the Babuk2 threat actor claims to have successfully gained unauthorized access to the internal database server of MYINDIHOME TELKOM INDONESIA. The group asserts that this breach allowed them to obtain a vast amount of customer service data. The scale of the alleged theft is significant, with the group claiming the data consists of 7 GB in a compressed format, which would equate to approximately 55 GB when uncompressed.

The timing of the announcement coincides with the claimed date of the attack, which was also January 28, 2025. While the group has made these claims publicly, information regarding the specific identity and operational methods of this threat actor remains limited in the public domain. Ransomware groups often use such platforms to claim responsibility for an intrusion, frequently employing double extortion tactics where they not only encrypt an organization's systems but also threaten to leak stolen data to maximize their leverage during negotiations.

Scope of the claimed data exposure

The leak announcement provides specific details regarding the types of information that the group claims to have exfiltrated from the organization. The sensitive nature of these data points suggests a high level of detail regarding the company's customer base. The information reportedly includes:

• IP addresses
• Email addresses
• Phone numbers
• Indihome subscription numbers
• Names
• ID card numbers (NIK)
• Device information
• Address information
• Subscription details

The exposure of such a diverse range of personally identifiable information (PII) poses significant risks to the individuals involved. When attackers gain access to a combination of names, ID numbers, and contact details, it creates a fertile ground for various forms of secondary cybercrime.

Organizational profile

IndiHome is a fixed broadband internet, IPTV, and telephone service brand provided by the Indonesian telecommunications company Telkom Indonesia. It provides digital communication solutions to homes and businesses across the country.

Risk assessment and industry implications

The alleged exposure of personally identifiable information may increase the risk of identity theft and fraud for the affected users. Furthermore, the sensitivity of the claimed data could facilitate targeted phishing attacks against customers, as attackers can use specific details like subscription numbers or device types to craft highly convincing fraudulent communications. The claim regarding the sale of access to the internal database may indicate a risk of secondary extortion or broader cyberattacks against the infrastructure.

From a regulatory perspective, the organization may face legal consequences under Indonesian data protection regulations due to the nature and scope of the exposed data. The severity of this incident may be considered high given the breadth of the information involved. In the telecommunications sector, such incidents underscore the critical importance of robust database security and strict access controls.

To defend against such threats, organizations in the technology and telecommunications sectors typically focus on several defensive layers. This includes implementing multi-factor authentication (MFA) across all internal systems, maintaining rigorous monitoring of database server access, and ensuring that sensitive customer data is encrypted both at rest and in transit. Additionally, regular vulnerability assessments and incident response planning are essential components of a modern cybersecurity posture to mitigate the impact of potential breaches.