Lockbit3 claims cyberattack against bankbsi.co.id

• Ransomware group: Lockbit3
• Country: Indonesia
• Sector: Financial Services
• Announcement date: May 12, 2023

LockBit3 claims a cyberattack against bankbsi.co.id

The LockBit3 ransomware group has announced that it conducted a cyberattack against bankbsi.co.id, a major financial institution in Indonesia. According to the group's announcement on their leak site, the attack has resulted in a significant disruption of the organization's services.

Details of the claimed attack

The LockBit3 group claims that the attack took place on May 8, 2023. According to the group's assertions, this specific operation was successful in completely halting all of the institution's services. The group has made serious allegations regarding the transparency of the institution's management following the incident. Specifically, it is alleged that the bank's management misled its customers and business partners by characterizing the disruption as "technical work" instead of acknowledging that a security breach had occurred.

Ransomware attacks of this nature often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a dual pressure point for the victim: the immediate need to restore operational continuity and the long-term need to manage the reputational and legal fallout from a potential data leak.

Data and evidence provided by the group

Regarding the specific nature of the information involved in this incident, the group has not provided details concerning the type of data that was leaked or threatened. No specific details regarding the nature of the leaked or threatened data have been provided by the attackers. The group has shared a screenshot that displays an interface used by the group to substantiate its claims regarding the victim's website, but no specific data types were listed in the announcement.

About Bank Syariah Indonesia (BSI)

Bank Syariah Indonesia (BSI) is an Islamic banking institution based in Indonesia. As the country's largest sharia-compliant bank, it provides a wide range of retail and corporate banking services to its client base.

Analysis and industry implications

This incident suggests that financial institutions may remain primary targets for ransomware actors. The disruption of services caused by such attacks can negatively impact customer trust and pose significant risks to operational continuity. For organizations in the financial sector, maintaining robust incident response plans and ensuring transparent communication with stakeholders is vital for maintaining stability.

Under Indonesian data protection regulations, the institution may face obligations regarding data breach notifications. Furthermore, the potential exposure of customer data in such incidents can lead to secondary risks, including identity theft and targeted phishing attacks. Organizations can mitigate these risks by implementing strong multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for employees.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. While its infrastructure was disrupted in February 2024, reports indicate that the group has since resumed operations, highlighting the persistent threat posed by organized ransomware collectives.