PT Intraco Penta Tbk listed on direwolf ransomware leak site

• Ransomware group: direwolf
• Country: Indonesia
• Sector: Manufacturing
• Announcement date: September 1, 2026

A major data breach claim against PT Intraco Penta Tbk

The threat actor known as direwolf has listed the Indonesian company PT Intraco Penta Tbk on its ransomware leak site. According to the claims made by the group, a significant volume of sensitive information has been compromised. The announcement, which appeared on the leak site on September 1, 2026, suggests that the organization has fallen victim to a data exfiltration attack.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish this information on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the disclosure of proprietary or personal information. This method increases the pressure on organizations, as the exposure of data can lead to severe reputational and legal consequences.

Details of the alleged data theft

The direwolf group claims that the breach involves approximately 64 GB of data. This stolen information is said to consist of 183,916 files. While the group has made these claims, public information regarding the specific capabilities and history of the direwolf group remains limited.

The content of the allegedly compromised data is extensive, spanning various critical business functions. The threat actor claims that the stolen files include:

• Procurement (P2P) processes
• Payment approvals
• General ledger records
• Tax returns
• SAP user data
• Employee information
• Bank account details
• Commercial invoices
• Vendor information

The breadth of this data suggests a deep intrusion into the organization's internal systems, touching upon financial, operational, and human resources departments.

About PT Intraco Penta Tbk

PT Intraco Penta Tbk is an Indonesia-based company that provides heavy equipment distribution, supply of equipment for mining, construction, and energy sectors, and after-sales services. The company specializes in heavy machinery and industrial solutions.

Potential impact and organizational risks

The alleged leak poses significant risks to the organization's financial operations and the privacy of its employees. Because the claimed data includes sensitive details such as bank account information, tax records, and vendor data, the breach could lead to secondary risks. These include the potential for identity theft or highly targeted phishing attacks directed at the organization's employees and its supply chain partners.

Furthermore, the organization may face legal consequences under Indonesian data protection regulations due to the nature of the compromised information. The publication of such data by a threat actor can cause lasting damage to the company's commercial reputation and may negatively impact its operational continuity. In the manufacturing and industrial solutions sector, maintaining the integrity of supply chain data and vendor information is critical for maintaining trust with global partners.

To defend against such threats, organizations typically implement various security measures. These include robust access controls, regular security audits, and comprehensive employee training to recognize phishing attempts. Additionally, maintaining offline backups and implementing strict network segmentation can help mitigate the impact of an intrusion and prevent attackers from moving laterally through the network to access sensitive financial and personnel databases.