Indonesia taxpayer identification number (NPWP) targeted by babuk2 ransomware group

• Ransomware group: babuk2
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: January 28, 2025

The threat actor known as babuk2 has published an announcement on its leak site claiming to have obtained a massive dataset belonging to the Indonesian taxpayer identification number (NPWP) system. The group asserts that they have successfully exfiltrated a significant volume of sensitive information related to taxpayers in Indonesia, marking a major potential data breach for the nation's tax administration infrastructure.

Details of the alleged data breach

According to the announcement posted by the babuk2 group on January 28, 2025, the threat actor claims to have made a dataset available through a public file-sharing platform. This dataset is reported to contain a total of 6,663,379 records, with an estimated total size of approximately 2 GB. The claim suggests that the breach occurred on the same day the announcement was made, January 28, 2025.

The information released by the group suggests a highly granular level of access to taxpayer records. Based on the details provided in the leak site announcement, the data allegedly leaked includes the following types of information:

• Name
• National identification number (NIK)
• Taxpayer identification number (NPWP)
• Address
• Email
• Phone number
• Date of birth
• Taxpayer information

The breadth of this claimed data suggests that the attackers may have gained access to core administrative records used for national tax tracking and identification purposes.

About the Indonesian taxpayer identification number (NPWP)

The NPWP (Nomor Pokok Wajib Pajak) serves as the official tax identification number used to identify taxpayers within Indonesia. This critical system is managed by the Indonesian tax authority for the purposes of tax administration and tracking. Because the NPWP is a fundamental component of the country's fiscal infrastructure, the data managed within this system is highly sensitive and central to the identification of individuals and entities for taxation purposes.

Potential impact and security implications

This incident may lead to the exposure of personal data belonging to millions of Indonesian taxpayers. Given the nature of the information claimed to be in the leak, the data could potentially be utilized by malicious actors for identity theft, targeted phishing attacks, and various financial fraud schemes. The inclusion of national identification numbers and contact details significantly increases the risk profile for the affected individuals.

At an institutional level, such a large-scale exposure of sensitive taxpayer data may trigger legal processes under existing data privacy regulations. For organizations and government entities in the government and defense sector, maintaining the integrity and confidentiality of such databases is paramount to national security and public trust. While information regarding the specific capabilities and history of the babuk2 group remains limited, the scale of this claimed breach suggests a significant security event.

In the context of modern cyber threats, ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's data to demand a ransom for decryption; they also steal sensitive information and threaten to leak it on public platforms if the ransom is not paid. This adds a layer of pressure on organizations, as the threat of public exposure can cause lasting reputational and legal damage, even if the systems are successfully restored from backups.

To mitigate the risks associated with such large-scale data breaches, organizations typically focus on robust defensive strategies. These include implementing strict access controls to limit the exposure of sensitive databases, employing continuous monitoring to detect unauthorized data exfiltration, and ensuring that all administrative access requires multi-factor authentication. Furthermore, regular security audits and the encryption of data at rest and in transit are standard industry practices used to protect against the unauthorized access of sensitive personal information.

Risk assessment for affected individuals

Given the large scale of the data involved in this claim, it is assessed that affected individuals may face long-term security risks. The combination of identity numbers, contact information, and tax status provides a comprehensive profile that can be exploited by criminals for extended periods to conduct sophisticated social engineering or financial crimes.