PLN listed on Dragonforce ransomware leak site

• Ransomware group: Dragonforce
• Country: Indonesia
• Sector: Energy & Utilities
• Announcement date: August 21, 2025

Dragonforce claims data breach at PLN

The ransomware group known as Dragonforce has listed data on its leak site that it claims belongs to PLN. This announcement, which appeared on the group's leak site on August 21, 2025, marks a significant development regarding the security posture of the Indonesian energy provider. The group has published a dataset that they claim was obtained during an attack that allegedly occurred on March 31, 2025.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then threaten to leak this information on public platforms if their demands are not met. This strategy places immense pressure on organizations, as the exposure of proprietary or sensitive information can lead to long-term reputational and legal consequences, even if the systems are successfully restored from backups.

Details of the claimed data leak

According to the announcement made by the Dragonforce group, the leaked information is associated with the core business operations of PLN, specifically regarding electricity generation, transmission, and distribution. The group has provided a dataset that is stated to be 3.83 GB in size. While the volume of the data has been specified, the group has not provided any specific details regarding the actual content or the specific types of files contained within the dataset.

The listing names no specific data types or individual files involved in the breach; the provided information is limited to a screenshot indicating the total size of the published dataset.

Profile of PLN

PLN (Perusahaan Listrik Negara) is Indonesia's state-owned sole electricity distribution company. It serves as the primary infrastructure entity responsible for the generation, transmission, and distribution of electricity across the country. Due to its role as a state-owned utility, the organization is a critical component of Indonesia's national infrastructure.

Potential impact and sector risks

This leak may pose a risk of exposing PLN's operational data or sensitive corporate information. Data breaches in organizations providing critical infrastructure services, such as the energy sector, could potentially create a foundation for secondary attacks or operational disruptions. When critical infrastructure providers are targeted, the implications often extend beyond simple data theft, as the information gained could be used to map networks or identify vulnerabilities for future exploitation.

Furthermore, the organization may face legal obligations under Indonesian data protection regulations following such an incident. Organizations in the energy and utility sectors often implement defensive measures such as network segmentation, continuous monitoring, and strict access controls to mitigate these risks. However, the evolving nature of ransomware groups remains a significant challenge for critical infrastructure protection.

It is important to note that the Dragonforce group has been active since 2023 and is reported to provide infrastructure to affiliates. Given this background, the possibility that this action is part of a broader campaign should be considered. The involvement of groups that operate as service providers for other affiliates suggests a sophisticated ecosystem where multiple entities may be targeted through shared methodologies or infrastructure.

General defensive considerations

To defend against such threats, organizations typically focus on several key areas:

• Implementing robust identity and access management to ensure only authorized personnel can access sensitive systems.
• Maintaining comprehensive, offline backups to ensure operational continuity in the event of encryption.
• Employing advanced threat detection and response capabilities to identify unauthorized data exfiltration in real-time.
• Conducting regular security audits and vulnerability assessments to identify weaknesses before they can be exploited by threat actors.