Kominfo.go.id data allegedly leaked by babuk2 group

• Ransomware group: babuk2
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: March 18, 2025

Massive data leak claimed against Indonesia's Ministry of Communication and Information Technology

The threat actor known as babuk2 has listed data allegedly belonging to kominfo.go.id on their leak site. In an announcement published on March 18, 2025, the group claims that the stolen information was obtained as far back as July 1, 2024. This alleged breach involves a massive volume of records, potentially impacting a significant portion of the Indonesian population.

Details of the alleged cyberattack

According to the announcement made by the babuk2 group, the dataset is substantial in size. The group claims the data is provided in a compressed format of 18 GB, which expands to 87 GB when uncompressed. The files are reportedly in CSV format and contain over 1.3 billion records. While the group has published this information on their leak site, public information regarding the specific identity and operations of the babuk2 group remains limited.

Ransomware groups often utilize leak sites to pressure organizations into paying ransoms, a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's internal systems but also steal sensitive data, threatening to publish it publicly if their demands are not met. This method increases the leverage held by the threat actor, as the reputational and legal consequences of a public leak can be devastating for the victimized entity.

Alleged affected data types

The leaked information is said to be related to the processes involved in prepaid SIM card registration. The specific data points allegedly contained within the 1.3 billion records include:

• National ID Card Number (NIK)
• Phone number
• Telco provider information
• Registration date

The target organization

The target of this alleged attack is the Ministry of Communication and Information Technology of Indonesia. This government agency is responsible for managing the country's communication, informatics, and media policies. Furthermore, the ministry oversees digital infrastructure, internet governance, and public information services, making it a critical pillar of the nation's digital landscape.

Impact assessment and security implications

This alleged leak poses a significant risk of exposing sensitive personal data belonging to Indonesian citizens. The combination of national ID numbers and phone numbers is particularly dangerous, as it could be utilized by malicious actors for identity theft and highly targeted phishing attacks. When attackers possess a combination of identity markers and contact information, they can craft much more convincing social engineering campaigns to deceive individuals.

Because the institution in question provides essential public services, it is assessed that this situation may have negative impacts on citizen security. The scale and nature of the data involved could trigger administrative and legal processes under Indonesian data protection regulations. Additionally, the publication of such data may form a basis for secondary attacks and could lead to significant reputational damage for the institution.

For organizations operating within the government and public service sectors, such incidents highlight the necessity of robust defensive measures. Common defensive steps include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and ensuring that sensitive databases are encrypted both at rest and in transit. Furthermore, organizations should focus on regular security audits and incident response planning to mitigate the impact of potential breaches and ensure compliance with national data protection laws.