Inc Ransom lists cnnindonesia.com on leak site claiming data breach

• Ransomware group: Inc Ransom
• Country: Indonesia
• Sector: Retail & E-Commerce
• Announcement date: January 28, 2025

The threat actor known as Inc Ransom has listed the Indonesian media organization cnnindonesia.com on its dedicated leak site. The group has made claims regarding a data breach involving the organization, marking a new development in the group's ongoing activities.

Details of the alleged attack

According to the announcement made on the group's leak platform on January 28, 2025, the threat actors claim to have gained unauthorized access to the organization's network. The group asserts that this access was established on January 5, 2025. While the listing confirms the target, the specific methods used to penetrate the network have not been disclosed by the group.

The announcement provided by the attackers includes certain non-technical details about the target. Specifically, the listing contains an estimated annual revenue figure for cnnindonesia.com, which is a common tactic used by ransomware groups to demonstrate their knowledge of a target's financial standing and to increase pressure during negotiations.

Information regarding the leaked data

At this stage, no specific details regarding the nature or the exact types of the allegedly leaked data have been provided by the threat actors. The screenshot associated with the listing contains only the general description of the organization and the aforementioned revenue estimate. The listing names no specific data types.

Potential risks and implications

Given the double-extortion tactics typically employed by the Inc Ransom group, there is a significant risk that sensitive data could be published. This group has been known to be active since mid-2023 and generally follows a strategy where they not only encrypt systems but also steal data to use as leverage for ransom demands.

Such a situation could potentially impact the operational continuity and the reputation of the organization. If the leaked data were to include employee or user information, it could trigger legal processes under relevant data protection regulations. Furthermore, there is a risk that any leaked data could be utilized for identity theft or targeted phishing attacks against the organization or its stakeholders.

About cnnindonesia.com

CNN Indonesia is an Indonesia-based news portal and media organization. It provides up-to-date news in various categories such as politics, economy, sports, technology, and lifestyle.

Security considerations for the media sector

For organizations operating in the media and information sector, such incidents highlight the importance of robust cybersecurity frameworks. Ransomware groups often target high-profile media outlets to maximize the impact of their leaks and the subsequent reputational damage.

To mitigate these risks, organizations often implement defensive strategies such as multi-factor authentication, regular offline backups, and continuous network monitoring. Because ransomware groups often use double-extortion, protecting the confidentiality of data is just as critical as ensuring the availability of systems. Organizations must also be prepared for the legal and regulatory complexities that arise when personal information is potentially compromised.