Pertamina listed on thegentlemen leak site following alleged data breach

• Ransomware group: thegentlemen
• Country: Indonesia
• Sector: Energy & Utilities
• Announcement date: July 31, 2026

Thegentlemen claims responsibility for Pertamina data breach

The threat actor group known as thegentlemen has listed the Indonesian energy corporation Pertamina on its leak site. According to the announcement published on July 31, 2026, the group claims to have successfully exfiltrated a significant volume of sensitive information belonging to the organization.

The group alleges that they gained unauthorized access to the company's networks, allowing them to copy various confidential files. The scale of the alleged theft is substantial, with the threat actor claiming to have stolen over 1.2 TB of data. While the group has posted this announcement on their leak site, they have not stated a specific ransom demand in connection with this incident.

Details of the alleged data exfiltration

The information allegedly stolen by thegentlemen covers a wide range of corporate, legal, and technical documentation. Although the group has not provided any screenshots to verify their claims, the list of compromised data types is extensive. The alleged breach includes a variety of sensitive records that could impact multiple departments within the organization.

The data types mentioned in the claim include:

• Non-disclosure agreements
• HR data
• User information
• Employee records
• Technical drawings
• Models
• Bank and tax records
• Legal statements
• SCADA documents
• Site photographs

In many modern cyberattacks, particularly those involving double extortion, threat actors steal sensitive data before encrypting systems. This tactic is used to pressure victims into paying a ransom by threatening to leak the stolen information on public forums or leak sites, even if the victim can restore their systems from backups.

About Pertamina

Pertamina is Indonesia's state-owned integrated energy corporation. It operates across the oil, natural gas, and renewable energy sectors, serving as a primary provider for the country's energy needs.

Potential implications and security risks

This alleged breach may pose significant operational and security risks for an entity operating critical energy infrastructure like Pertamina. The potential exposure of SCADA documents and technical drawings is particularly concerning, as it could lead to secondary attack vectors targeting facility security. Such information often provides a roadmap for how industrial control systems function, which can be exploited in future targeted attacks.

Furthermore, the disclosure of employee and financial data may increase the risk of identity theft and targeted phishing attacks against the affected individuals. Given the state-owned nature of the organization, the incident may also have implications for national security. The breach could result in reputational damage and potential regulatory scrutiny for the organization.

For organizations operating in the energy and utilities sector, defending against such threats requires a multi-layered approach. Common defensive steps include implementing robust network segmentation to protect industrial control systems from IT network breaches, enforcing strict access controls, and maintaining comprehensive logging and monitoring to detect unauthorized movement within the network. Additionally, regular security awareness training can help mitigate the risk of phishing, while offline, immutable backups are essential for maintaining operational continuity in the event of a successful ransomware attack.