MYINDIHOME TELKOM INDONESIA listed on Babuk2 leak site

• Ransomware group: Babuk2
• Country: Indonesia
• Sector: Technology
• Announcement date: January 28, 2025

Babuk2 claims data breach at MYINDIHOME TELKOM INDONESIA

The Babuk2 ransomware group has officially listed MYINDIHOME TELKOM INDONESIA on its dedicated leak site. According to the announcement made on January 28, 2025, the threat actors claim to have successfully breached the organization and obtained a significant amount of internal data. The group has asserted that they have gained access to the organization's internal database server, specifically targeting customer service information.

This incident follows a pattern often seen in modern cyberattacks where threat actors move beyond simple encryption to more aggressive tactics. By listing a target on a public leak site, the group aims to exert maximum pressure on the victim organization. This tactic is frequently associated with double extortion strategies, where attackers not only lock an organization's systems but also threaten to release sensitive information to the public to coerce the victim into paying a ransom.

Details of the alleged data theft

The threat group claims to have exfiltrated approximately 55 GB of data from the organization. While the specific file count was not provided in the announcement, the group has begun sharing a portion of the alleged data to demonstrate the validity of their claims and increase the pressure on the target. The leaked information is described as being highly sensitive, containing various types of personally identifiable information (PII) and technical details related to the organization's user base.

The alleged content of the stolen data includes the following items:

• IP addresses
• Email addresses
• Phone numbers
• Indihome subscriber numbers
• Names
• ID card numbers (NIK)
• Device information
• Address information
• Subscription information

The presence of such a wide array of data points, ranging from contact details to unique identification numbers like the NIK, suggests a significant compromise of the organization's customer database.

About MYINDIHOME TELKOM INDONESIA

IndiHome is a fixed broadband internet, telephone, and IPTV service provided by Telkom Indonesia. As a state-owned telecommunications company based in Indonesia, Telkom Indonesia operates one of the largest internet service providers in the country. Due to its scale and the essential nature of its services, the organization maintains a vast database of subscribers across the region.

Risks and recommended defensive measures

This incident may pose significant secondary risks to the organization's customers, such as identity theft and highly targeted phishing attacks. When attackers possess a combination of names, phone numbers, email addresses, and ID card numbers, they can craft extremely convincing social engineering campaigns to defraud individuals.

Furthermore, the presence of personally identifiable information in the alleged leak could lead to serious legal and administrative consequences for the organization under Indonesian data protection regulations. Organizations operating in the telecommunications sector must be particularly vigilant, as they handle massive volumes of sensitive subscriber data that is highly valuable on the dark web.

In response to such threats, it is generally advisable for organizations to initiate an urgent digital forensic investigation to verify the validity of the leak claims and determine the full scope of the breach. Additionally, notifying affected customers is a critical step in mitigating harm and maintaining transparency. To defend against such sophisticated actors, organizations typically implement robust monitoring of database servers, strict access controls, and comprehensive encryption protocols for data at rest and in transit. Because information about the Babuk2 group remains limited, organizations should remain cautious of their evolving tactics.