Next TI listed on fog ransomware leak site

• Ransomware group: fog
• Country: Indonesia
• Sector: Technology
• Announcement date: February 19, 2025

The Indonesian technology company Next TI has been listed on the leak site of the ransomware group known as fog. According to an announcement made by the threat actor, the company has been targeted in a data breach involving a significant amount of information.

The claimed attack event

The threat actor identified as fog published a post on February 19, 2025, claiming to have compromised data belonging to Next TI. The announcement specifically references GitLab data as the source of the breach. The group has highlighted the company's operations in the field of financial digital platforms while listing the data for public access on their leak site.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data. The goal is to pressure the victim into paying a ransom by threatening to leak the stolen information publicly. This method increases the leverage held by the attackers, as the threat of data exposure can cause significant reputational and regulatory damage to the victimized organization.

The claimed data involvement

The announcement claims that 8 GB of data has been leaked. The group alleges that this dataset was extracted from the company's GitLab platform. While the volume of the data has been specified, no specific details regarding the nature of the data types were provided in the announcement.

Summary of claimed data

• 8 GB of data allegedly extracted from GitLab

When organizations face such incidents, it is common for attackers to withhold specific details about the data types initially, using the uncertainty to increase pressure on the target. The lack of specific information regarding the content of the 8 GB dataset means the exact nature of the compromised files remains unconfirmed by the announcement.

The organization profile

Next TI is an Indonesian technology company that specializes in the development of digital platforms for the banking and finance industry. The company's operations are supported by the South Korean Hana Financial Group.

Potential implications and defensive considerations

This incident may lead to the exposure of intellectual property or sensitive software code within Next TI. Given that the data was allegedly obtained from GitLab, it suggests that the company's source code or internal software infrastructure may have been compromised. This possibility introduces significant concerns regarding the integrity of the software being developed for the financial sector.

Because Next TI maintains partnerships in the financial sector, the leak could potentially trigger supply chain risks. In a supply chain attack, a compromise in a service provider or software developer can propagate vulnerabilities or malicious code to their downstream clients, potentially impacting the broader financial ecosystem. Organizations operating within these critical sectors must be aware that a breach at a single technology provider can have cascading effects.

The group responsible for this claim, fog, is characterized by limited publicly available information. When dealing with such actors, organizations often face challenges in attribution and understanding the full scope of the threat.

To mitigate potential risks such as identity theft or targeted phishing attacks, affected parties may need to analyze the leaked content thoroughly. General defensive steps for organizations in the technology and financial sectors include implementing strict access controls for code repositories, monitoring for unauthorized data exfiltration, and maintaining robust incident response plans to address both system encryption and data leakage scenarios.