MyPertamina Indonesia listed on Babuk2 ransomware leak site

• Ransomware group: Babuk2
• Country: Indonesia
• Sector: Energy & Utilities
• Announcement date: January 28, 2025

Babuk2 claims to have compromised MyPertamina Indonesia

The Babuk2 ransomware group has officially listed MYPERTAMINA INDONESIA on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully obtained data belonging to the organization. This development marks a significant incident involving a major digital service platform in the Indonesian energy sector.

The announcement was published on January 28, 2025, with the group claiming the attack occurred on the same day. While the group has initiated a process for the publication of the alleged stolen data, specific details regarding the group's operations and the full scope of the incident remain limited at this time. No information was provided regarding the total size of the data or the specific number of files involved in the breach. Furthermore, there was no mention of a specific ransom demand in the public announcement.

Details of the alleged data breach

The threat actor alleges that the breach targeted the digital financial services platform managed by the organization. According to the claims made by the Babuk2 group, the compromised data is highly sensitive and includes a wide range of personal and financial identifiers. The group asserts that the stolen information could potentially be used for various malicious purposes.

The data types reportedly included in the breach are as follows:

• Name
• Email
• National identity number (NIK)
• Tax identification number (NPWP)
• Telephone number
• Address
• Date of birth
• Gender
• Income information

The presence of such specific identifiers, particularly national and tax identification numbers, suggests a high level of sensitivity regarding the information the group claims to possess.

About MyPertamina Indonesia

MyPertamina is a digital service and payment platform managed by Pertamina, which is Indonesia's state-owned oil and natural gas corporation. The platform serves as the official application for users to manage various energy-related tasks. This includes managing fuel purchases, participating in loyalty programs, and handling payments for a variety of energy services provided by the corporation.

Potential risks and organizational implications

This alleged data leak may pose significant secondary risks to the organization's users. Specifically, the exposure of personal identifiers such as names, addresses, and national ID numbers can facilitate identity theft and the execution of highly targeted phishing attacks. When attackers possess detailed information like income details and contact numbers, they can craft much more convincing social engineering campaigns to deceive victims.

Given the sensitivity of the mentioned data, the incident could trigger legal processes under Indonesian data protection regulations. In modern cyberattack landscapes, ransomware groups often employ a double-extortion scheme. In this tactic, attackers do not just encrypt an organization's systems but also steal sensitive data, threatening to leak or sell it on the dark web if a ransom is not paid. Considering the known tactics of the Babuk2 group, there is a possibility that the data may be leaked or sold as part of such a scheme.

For organizations operating in critical sectors like energy and utilities, such incidents highlight the necessity of robust security measures. General defensive steps for organizations facing such threats include reviewing and strengthening security architectures, implementing strict access controls, and maintaining comprehensive monitoring to detect unauthorized access. Additionally, it is often advisable for organizations to proactively inform their users about potential risks to mitigate the impact of identity theft and phishing attempts.