Indika Energy listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Indonesia
• Sector: Energy & Utilities
• Announcement date: July 9, 2024

Hunters ransomware group targets Indika Energy

The Hunters International ransomware group has officially listed the Indonesian organization Indika Energy on its dedicated leak site. According to the claims made by the threat actors, the company has fallen victim to a cyberattack involving both the exfiltration of sensitive information and the encryption of corporate systems. The announcement, which was posted on July 9, 2024, remains active on the group's digital platform.

Ransomware attacks of this nature often follow a pattern of double extortion. In these scenarios, threat actors do not merely lock the victim's files to demand a ransom for decryption; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on public forums or leak sites, attackers increase the pressure on the victim to comply with their demands. This method is designed to maximize the impact of the breach, targeting the organization's reputation and its legal obligations regarding data privacy.

Details of the claimed attack

The Hunters International group claims to have successfully gained access to the internal systems of Indika Energy. The group asserts that their intrusion resulted in two distinct stages of impact: the unauthorized extraction of data from the network and the subsequent encryption of files within the company's environment. This dual-action approach is a hallmark of modern ransomware operations, aiming to disrupt business continuity while simultaneously creating a secondary layer of extortion through data exposure.

Regarding the specific nature of the compromised information, the group has not provided any specific details regarding the content of the exfiltrated or encrypted data. The listing does not specify the types of files, the volume of data, or the specific business departments affected. The announcement is limited to the claim that data was exfiltrated and encrypted.

About Indika Energy

PT Indika Energy Tbk is a prominent Indonesian diversified holding company. The organization maintains a broad operational footprint across several critical sectors, including energy, logistics, infrastructure, and mining. The company is a significant player in the region, providing various energy solutions with a primary focus on power generation and coal production.

Potential implications and industry context

The claims made by the Hunters International group suggest a potential for significant disruption to the operational continuity of Indika Energy. When encryption occurs within a large-scale industrial or energy firm, it can lead to prolonged interruptions in business processes, potentially affecting supply chains and service delivery. Furthermore, the exfiltration of data poses a serious risk of exposing sensitive information belonging to employees or business partners.

Because Indika Energy is based in Indonesia, such a breach may present significant challenges regarding compliance with local data protection regulations. Organizations operating in the energy and utilities sector are often considered critical infrastructure, making them high-value targets for sophisticated threat actors. The group involved in this incident is believed to be derived from the Hive codebase, which suggests that organizations might face secondary extortion attempts or targeted phishing attacks utilizing similar methodologies.

To mitigate the risks associated with such threats, organizations in the energy and utility sectors typically focus on several defensive pillars. These include implementing robust network segmentation to prevent lateral movement by attackers, maintaining rigorous backup and recovery protocols to combat encryption, and conducting continuous monitoring to detect unauthorized data exfiltration. Additionally, because these groups often use phishing as an entry vector, comprehensive employee training remains a vital component of a modern cybersecurity posture.