Indonesia's Customs Analytics Platform targeted by Everest ransomware group

• Ransomware group: Everest
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: April 28, 2026

Everest ransomware group claims data breach at Indonesia's Customs Analytics Platform

The threat group known as Everest has published data allegedly belonging to Indonesia's Customs Analytics Platform on its leak site. This announcement marks a significant escalation in the group's activities, targeting a critical piece of government and defense infrastructure in Indonesia.

Details of the claimed attack

According to the listing on the Everest leak site, the group targeted the organization on April 28, 2026. The threat actors claim to have successfully exfiltrated a substantial volume of information from the organization's systems. Specifically, the group claims to have obtained 44.8 GB of data, which is comprised of 437 files.

The group has employed a common tactic used by modern ransomware operators known as double extortion. In this model, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release the stolen data publicly, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. In this specific instance, the Everest group has stated that the data may be fully released if the organization does not establish contact with them.

Data and files involved in the leak

The screenshots provided by the threat actors in the leak offer a glimpse into the nature of the compromised information. The leaked content appears to contain highly sensitive administrative and economic data. Based on the available evidence, the stolen information includes data related to 173,292 companies, customs analysis reports, company performance metrics, and various statistical tables.

The specific types of data identified in the listing include:

• Company analysis data
• Customs reports
• Statistical tables

The exposure of such a vast amount of data, particularly when it involves hundreds of thousands of corporate entities, represents a significant breach of confidentiality. Such information is often highly sought after by various malicious actors for secondary exploitation.

The risks of data exposure and organizational implications

This incident may pose a risk to the confidentiality and security of Indonesian customs data. The exposure of company information within the organization's database could potentially facilitate corporate espionage or targeted phishing attacks. When large datasets containing corporate metrics and analysis are leaked, malicious actors can use the details to craft highly convincing social engineering campaigns or to gain insights into the economic activities of specific entities.

Given the past activities of the Everest group, there is a possibility that such data may be used for extortion or sold to third parties. This highlights the persistent threat posed by ransomware-as-a-service (RaaS) groups that prioritize the monetization of stolen data through various illicit channels.

For organizations operating within the government and defense sectors, such incidents underscore the necessity of robust cybersecurity frameworks. To mitigate the impact of such breaches, organizations typically need to initiate an investigation in accordance with data breach notification requirements and national cybersecurity regulations. Defensive strategies often involve implementing strict access controls, continuous monitoring of network traffic for unusual data exfiltration patterns, and maintaining comprehensive incident response plans to address both the technical and legal ramifications of a data breach.