Bayu Buana Travel Service targeted by crypto24 ransomware group

• Ransomware group: crypto24
• Country: Indonesia
• Sector: Hospitality
• Announcement date: November 15, 2025

Crypto24 claims data exfiltration from Bayu Buana Travel Service

The threat actor known as crypto24 has announced a significant data breach involving the Indonesian travel agency, Bayu Buana Travel Service. According to a post made on a ransomware leak site on November 15, 2025, the group claims to have successfully exfiltrated a massive volume of data from the organization's internal systems.

The group alleges that the intrusion occurred around October 20, 2025. While the group has made these claims publicly, information regarding the specific identity and operational methods of the crypto24 group remains limited in the public domain. As is common with many ransomware operations, the group has not provided any screenshots to verify the validity of their claims at this time.

Details of the alleged data breach

The threat actor claims to have gained unauthorized access to the internal network of the organization. The scale of the alleged theft is substantial, with the group asserting that they have extracted approximately 500 GB of data from the victim's systems. This volume of data suggests a deep penetration into the corporate environment.

The specific types of information the group claims to have stolen include:

• Internal company documents
• Customer information
• Project details

The disclosure of such diverse data types suggests that the attackers may have targeted various departments within the organization, ranging from administrative functions to client-facing operations.

About Bayu Buana Travel Service

Bayu Buana Travel Service is a well-established travel agency based in Indonesia. The organization provides a wide range of comprehensive travel services to its clientele, including airline ticketing, hotel reservations, visa processing, and various tour packages. Given its role in the hospitality sector, the agency handles a significant amount of sensitive information related to international and domestic travel logistics.

Potential impact and industry implications

The alleged exposure of this data may pose significant risks to the organization's operational integrity and customer privacy. The disclosure of customer information could potentially lead to identity theft or targeted phishing attacks against the affected individuals. Furthermore, the breach of corporate data could result in reputational damage and vulnerabilities within the supply chain.

Under Indonesian data protection regulations, the organization may face legal obligations and potential administrative sanctions. If the threat actor employs double extortion tactics—a method where attackers not only encrypt data but also threaten to leak it unless a ransom is paid—it is possible that a ransom demand may be issued to prevent the publication of the stolen data.

In the hospitality and travel sector, organizations often face high risks due to the volume of personal identifiable information (PII) they process. To mitigate such risks, industry experts generally recommend robust defensive measures. These include implementing multi-factor authentication (MFA) across all remote access points, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups and implementing network segmentation can help limit the lateral movement of an attacker once they have gained initial access to the network.