PT Kalimantan Prima Persada targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: Indonesia
• Sector: Energy & Utilities
• Announcement date: November 7, 2025

Medusa ransomware group claims data breach against PT Kalimantan Prima Persada

The Medusa ransomware group has officially announced a data leak claim against PT Kalimantan Prima Persada on their dedicated leak site. According to the announcement made on November 7, 2025, the threat actors claim to have successfully conducted a cyberattack against the organization, resulting in the acquisition of company data. This incident highlights the ongoing threat posed by ransomware groups targeting industrial entities through various exploitation methods.

Details of the claimed attack and ransom demand

The Medusa group claims to have carried out the attack on November 6, 2025. In their announcement, the threat actors are demanding a ransom of 100,000 USD in exchange for not publishing the stolen information. This tactic is a hallmark of modern ransomware operations, where the goal is not just to encrypt systems but to leverage the threat of data exposure to coerce payments.

To support their claims of a successful intrusion, the group has shared sample documents on their leak site. These samples appear to consist of various documents related to the company's operations. However, the group has not provided specific details regarding the full scope of the breach or the exact volume of the data they claim to have exfiltrated.

Information regarding the compromised data

The content of the shared screenshots and samples suggests that the stolen information includes documents that appear to be tables and reports related to mining operations. Despite these samples, there is no detailed information available regarding the specific types of the compromised data or the total number of files involved in the incident.

• Mining operation reports and tables

The listing does not provide a comprehensive list of all data types or the total file count, leaving the full extent of the potential exposure unknown.

About PT Kalimantan Prima Persada

PT Kalimantan Prima Persada (KPP) is a subsidiary of PT Pamapersada Nusantara that operates within the coal mining sector. The company provides a wide range of mining services, spanning from the initial exploration stages through to sales. Its primary operations are conducted within the Kalimantan region of Indonesia.

Risk assessment and industry implications

This incident suggests a significant risk that the company's operational data and employee information could be exposed. The Medusa group employs a double extortion method, which involves both encrypting data and threatening to leak it. This approach can lead to severe reputational damage and potential legal consequences for the organization if the data is eventually published by the attackers.

As an industrial company operating in the energy and utilities sector, the leaked data might contain sensitive trade secrets or critical infrastructure information. Such a leak could pose secondary risks for the company's various supply chain partners, as interconnected business processes often mean that a breach in one organization can impact others in the network.

In general, when organizations face such threats, common defensive steps include implementing robust backup strategies, enforcing multi-factor authentication, and maintaining strict network segmentation. For companies in the industrial sector, protecting critical infrastructure information and ensuring the integrity of operational data is paramount to maintaining business continuity and protecting against the cascading effects of a supply chain compromise.