PT Bank Pembangunan Daerah Banten Tbk listed by Medusa ransomware group

• Ransomware group: Medusa
• Country: Indonesia
• Sector: Financial Services
• Announcement date: March 27, 2024

Medusa ransomware group claims data breach at PT Bank Pembangunan Daerah Banten Tbk

The Medusa ransomware group has listed PT Bank Pembangunan Daerah Banten Tbk on its leak site, claiming to possess a significant amount of stolen data. According to the announcement made on March 27, 2024, the group alleges that they have successfully compromised the institution's systems and obtained sensitive information.

This incident involves allegations of a data breach that could potentially impact the institution's financial operations. The group's announcement suggests that they have gained unauthorized access to the organization's internal environment, leading to the claimed exfiltration of data.

Details of the alleged data theft

The Medusa group claims that the stolen data consists of 108.47 GB of information. While the group has not provided any screenshots to verify their claims, they have specified the nature of the compromised files. The leaked content is said to include SQL databases that contain sensitive customer financial information. No specific file count or ransom demand has been disclosed by the group in their announcement.

The data allegedly involved in this breach includes:

• Customer financial information
• SQL database records

Impact and potential risks of the incident

This incident may pose a significant risk of exposing sensitive financial data belonging to the institution's customers. Such a breach can lead to various negative consequences for the organization, including potential reputational damage and disruptions to the institution's operational processes. Furthermore, the exposure of this information means that customers may become vulnerable to identity theft and targeted phishing attacks.

Given that the Medusa group is known for employing a double extortion method, the institution may face both financial and regulatory consequences. Double extortion is a common tactic used by modern ransomware groups, where they not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the stolen data on a public leak site, attackers increase the pressure on the victim to pay the ransom.

In the financial services sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Organizations in this sector can take several defensive steps to mitigate these risks, such as implementing strict access controls, maintaining comprehensive logging and monitoring, and ensuring regular, offline backups of critical databases. Because public information regarding the Medusa group remains limited, organizations must remain vigilant against their evolving tactics.

Summary of the claim

To summarize, the Medusa group has claimed a successful attack against PT Bank Pembangunan Daerah Banten Tbk, alleging the theft of 108.47 GB of data, including SQL databases with customer financial information. The organization faces potential operational, reputational, and regulatory risks as a result of these allegations.