Cazh.id targeted by Icarus ransomware group in alleged data breach

• Ransomware group: Icarus
• Country: Indonesia
• Sector: Financial Services
• Announcement date: May 5, 2026

Icarus claims to have compromised Cazh.id data

The threat actor group known as Icarus has published an announcement on its leak site claiming to have obtained extensive user and financial data belonging to Cazh.id. According to the post, the group successfully breached the systems of the Indonesian organization, allegedly gaining access to sensitive databases and internal assets. While the group has made these claims, public information regarding the specific operations and identity of the Icarus group remains limited.

The alleged incident was announced on May 5, 2026, with the group claiming the attack occurred on the same day. The breach appears to target a significant volume of information, including not only user-related data but also critical corporate assets such as source code. No screenshots were provided by the group to substantiate their claims during the announcement.

Details of the alleged data theft

The scope of the data claimed by Icarus is vast, encompassing a wide variety of personal, financial, and corporate information. The group asserts that they have accessed the institution's user databases, Know Your Customer (KYC) documents, and proprietary source code. This includes a significant amount of sensitive documentation used for identity verification and financial transactions.

The specific types of data allegedly stolen include:

• User email addresses
• Password hashes
• Phone numbers
• Address information
• Dates of birth
• Government ID documents
• KYC selfies
• Student and parent data
• Investor data
• Property and vehicle registration documents
• Source code

Beyond individual user records, the group claims to have obtained 34 SQL databases associated with various schools. The stolen information also reportedly includes investor databases, vehicle registration documents, property deeds, and proofs of billing. The breadth of this alleged theft suggests a deep penetration into the organization's data architecture.

About Cazh.id

Cazh is an Indonesia-based financial technology company. It provides digital payment systems, school management solutions, and financial services, particularly for educational institutions and individual users.

Risks and implications of the breach

The nature of the allegedly leaked data poses a high risk of identity theft and fraud for the institution's users. The exposure of KYC documents and highly personal information could lead to targeted phishing attacks against the affected individuals. Furthermore, the release of source code might facilitate the discovery of additional vulnerabilities, potentially leading to secondary attacks against the organization or its clients.

The organization may also face legal sanctions under Indonesian data protection regulations due to the exposure of such sensitive information. Given the possibility that the group employs double extortion tactics—a method where attackers not only encrypt data but also threaten to leak it to increase pressure—the publication of this data may further exacerbate institutional reputational damage.

In such scenarios, organizations in the financial services sector often face significant challenges. When sensitive identity documents and financial proofs are compromised, the impact extends beyond the immediate digital infrastructure to the real-world security of the individuals involved. Defensive measures typically involve rigorous monitoring of database access, encryption of sensitive fields, and strict adherence to regional data protection laws to mitigate the fallout from potential leaks.