Blackshrantac claims data breach at Badan Pengelola Keuangan Haji

• Ransomware group: Blackshrantac
• Country: Indonesia
• Sector: Financial Services
• Announcement date: November 29, 2025

Blackshrantac claims to have leaked data from Badan Pengelola Keuangan Haji

The threat actor known as Blackshrantac has listed the Indonesian government agency Badan Pengelola Keuangan Haji on its leak site. The group claims to have exfiltrated a significant amount of data from the organization, alleging that a 200 GB dataset has been compromised. This announcement, made on November 29, 2025, suggests a major breach involving sensitive information belonging to the institution.

Details of the alleged breach

According to the claims made by Blackshrantac, the group has successfully exfiltrated data from the organization. To support their allegations of a successful intrusion, the threat actor provided several screenshots as evidence. These screenshots reportedly depict internal operational documents and various employee records belonging to the agency. This method of providing visual proof is a common tactic used by ransomware groups on their leak sites to demonstrate the legitimacy of their claims and to pressure organizations during extortion attempts.

Ransomware groups often employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to compel the victim to pay a ransom. While the specific ransom demand in this instance remains unknown, the publication of the breach on a leak site is a hallmark of this extortion technique.

Reported sensitive data types

The announcement made by the group specifies that the stolen dataset contains a wide variety of sensitive information. The leaked data is said to include:

• Personal identification data
• Health information
• Religious information
• Biometric data
• Bank account information
• Hajj deposit records
• Transaction history
• Passwords
• Electronic signatures
• Access logs

About Badan Pengelola Keuangan Haji

Badan Pengelola Keuangan Haji (BPKH) is the Indonesian government agency responsible for managing Hajj pilgrimage funds. The institution oversees the management of funds collected for Hajj, ensuring that these resources are utilized efficiently and transparently for the pilgrims.

Potential impact and organizational risks

This alleged breach may pose significant risks to the financial operations of the organization and the personal data of Hajj pilgrims. The inclusion of highly sensitive information, such as biometric and health data, in the leaked dataset could increase the likelihood of identity theft and targeted phishing attacks against the affected individuals. Furthermore, the exposure of financial records could result in reputational damage and operational disruptions for the institution.

From a regulatory perspective, this incident may lead to legal consequences regarding compliance with Indonesian data protection regulations. Organizations in the financial services sector must maintain rigorous security postures to protect sensitive data and comply with national laws. Common defensive steps for organizations include implementing multi-factor authentication, maintaining strict access controls, conducting regular security audits, and ensuring robust encryption for data at rest and in transit. The limited public information available regarding the Blackshrantac group makes it difficult to assess the full scope of their typical operations.