pajak.go.id allegedly targeted by Babuk2 ransomware group

• Ransomware group: Babuk2
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: March 18, 2025

The Babuk2 ransomware group has listed the Indonesian Directorate General of Taxes, operating via the pajak.go.id domain, on its leak site. The threat actors claim to have successfully executed a data breach against the institution, asserting that they have obtained a significant volume of sensitive information belonging to the government entity.

Details of the alleged breach

According to the announcement made on March 18, 2025, the Babuk2 group claims to have exfiltrated over 6.6 million records from the institution's database. The threat actors specified that the stolen data is provided in CSV format and reaches a total size of 2 GB. While the group has published this claim on their leak site, public domain information regarding the specific operations and background of the Babuk2 group remains limited.

Ransomware leak sites are frequently used by cybercriminal groups as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's internal systems but also steal sensitive data to use as leverage. By threatening to publish this information publicly, the attackers aim to pressure the victim into paying a ransom. This method increases the pressure on the target, as the exposure of private or government data can lead to severe reputational and legal consequences.

Claimed data contents

The announcement made by the threat actors claims that the leaked dataset contains a wide array of personal and administrative information. The contents of the alleged breach reportedly include various identifiers used for tax and identity purposes within Indonesia. The specific types of data mentioned in the claim include:

• Names
• National identity numbers (NIK)
• Tax identification numbers (NPWP)
• Addresses
• Emails
• Phone numbers
• Dates of birth
• Taxpayer status information

The availability of such detailed personal information in a structured format poses significant risks to the privacy of the affected individuals. When sensitive identifiers like national identity numbers and tax IDs are compromised alongside contact information, it creates a high risk for secondary crimes. Such data can be utilized by malicious actors to conduct identity theft or to launch highly targeted phishing attacks against citizens.

Organization profile

Pajak.go.id serves as the official web portal for the Directorate General of Taxes, which operates under the Ministry of Finance of Indonesia. The institution is a critical component of the country's financial infrastructure, providing essential services including tax administration, filing services, and the dissemination of tax regulation information to taxpayers throughout Indonesia.

Implications and defensive considerations

This alleged breach carries significant implications for both the privacy of Indonesian citizens and the broader security landscape. Because the target is a government entity, the incident may raise concerns regarding national security and the maintenance of public trust in state institutions. Furthermore, the exposure of such data may trigger legal obligations for the organization under Indonesia's existing data protection regulations. There is also the possibility that the leaked data could be traded in secondary markets or utilized by other criminal groups for various illicit activities.

For organizations operating within the government and defense sectors, maintaining robust cybersecurity postures is essential to mitigate these types of risks. Defensive strategies typically involve implementing multi-factor authentication (MFA) across all administrative access points, maintaining strict network segmentation to prevent lateral movement by attackers, and ensuring comprehensive logging and monitoring to detect unauthorized data exfiltration. Additionally, regular backups and rigorous patch management are fundamental practices to defend against the initial stages of a ransomware intrusion. Given the sensitive nature of tax and identity data, continuous monitoring of data access patterns is a critical component of a modern security framework.