bri.co.id targeted by apt73 in alleged data breach

• Ransomware group: apt73
• Country: Indonesia
• Sector: Financial Services
• Announcement date: December 18, 2024

apt73 claims to have compromised bri.co.id data

The threat actor identified as apt73 has published an announcement on its leak site claiming to possess sensitive information belonging to bri.co.id. This announcement, posted on December 18, 2024, suggests that the group has successfully targeted the Indonesian financial institution. While the group has made public various data samples allegedly related to the institution via their leak site, public information regarding the specific identity and operations of the apt73 group remains limited.

According to the post made by the threat actor, the breach involves a significant amount of data that has reportedly been sold to a third party. This method is a common tactic used by ransomware groups operating via leak sites, often employing a strategy known as double extortion. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly or sell it to competitors and malicious actors.

The group has provided screenshots and sample documents to support their claims. These samples serve as a way for the threat actor to demonstrate the validity of the stolen information to potential buyers or to increase pressure on the victim organization. At this stage, the specific volume of the data and the exact amount of any ransom demand have not been disclosed by the group.

Details of the allegedly stolen information

The data samples visible in the materials released by apt73 indicate a wide range of sensitive information that may have been exfiltrated from the organization. The content of these documents suggests that the breach encompasses various categories of information that are highly valuable for malicious purposes.

The following types of data are reportedly included in the leak:

• Customer personal data
• Financial data
• Contact information
• Address information

Specifically, the visible documents appear to contain customer names, dates of birth, phone numbers, credit card numbers, approval statuses, company information, and address details. The exposure of such a diverse set of information increases the potential impact of the incident on the affected individuals.

About Bank Rakyat Indonesia (BRI)

Bank Rakyat Indonesia (BRI) is one of the largest commercial banks in Indonesia, providing personal and commercial banking services. The institution specializes in microfinance and operates through an extensive branch network, making it a critical component of the Indonesian financial landscape.

Potential impact and industry implications

This alleged leak may pose significant risks of identity theft and financial fraud for the customers of the institution. For an entity operating within the financial services sector, the exposure of such sensitive data could lead to a loss of customer trust and may result in potential sanctions under various regulatory frameworks. The security of customer data is a cornerstone of banking operations, and any compromise can have long-lasting reputational consequences.

The claim that the data has been sold to third parties may increase the likelihood that the information will be utilized in targeted phishing attacks by malicious actors. When attackers possess specific details like names, phone numbers, and transaction-related information, they can craft highly convincing messages to deceive victims. Furthermore, it is possible that the leaked data could be disseminated more widely across underground forums in the coming period, further increasing the risk to the public.

In response to such incidents, organizations typically need to fulfill data breach notification obligations and inform affected customers to mitigate harm. Defensive measures for organizations in the financial sector often include implementing robust encryption, maintaining strict access controls, and conducting regular security audits to detect unauthorized access early. As the threat landscape evolves, the ability to respond quickly to data leaks is essential for maintaining regulatory compliance and institutional integrity.