Purwana Group targeted by Direwolf ransomware group

• Ransomware group: Direwolf
• Country: Indonesia
• Announcement date: September 7, 2025

The threat actor known as Direwolf has listed 40 GB of data allegedly belonging to Purwana Group on its leak site. This announcement, made on September 7, 2025, follows a claimed attack date of September 6, 2025. The threat actor claims to have obtained a significant dataset, and the group has set a deadline for the full publication of the stolen information.

The claimed attack and event details

According to the announcement made by the Direwolf group, a data leak incident involving Purwana Group was initiated on September 6, 2025. The threat actor claims to have successfully exfiltrated a 40 GB dataset that contains the organization's financial and operational records. This type of activity is characteristic of modern ransomware operations where attackers focus on data theft to increase their leverage over a victim.

The announcement indicates a structured timeline for the exposure of the stolen information. The threat actor has stated that all of the allegedly compromised data is scheduled to be published on the group's leak site on September 30, 2025. This countdown mechanism is a common tactic used by ransomware groups to exert pressure on organizations to meet ransom demands before the sensitive information is made public.

The content of the alleged leak

The information provided by the threat actor suggests that the breach involves a wide array of sensitive corporate and personal information. The leak is stated to include various types of documentation that could be highly damaging if released. Specifically, the group claims that the stolen data includes:

• Financial data
• Tax records
• Customer data
• Subsidiary data

The presence of such diverse data types, ranging from tax records to customer information, indicates that the attackers may have gained access to multiple internal systems or databases within the organization's infrastructure.

Implications and risk assessment

This incident suggests that sensitive corporate and customer data within Purwana Group may be at risk of exposure. The allegedly compromised data could potentially be utilized for identity theft or targeted phishing campaigns. When attackers obtain customer information and financial records, they often use this data to conduct highly convincing social engineering attacks against both the organization and its clients.

Furthermore, the organization may face legal obligations under Indonesian data protection regulations due to the nature of the data involved. The group appears to be employing double-extortion tactics, a method where the threat actor not only encrypts the victim's systems but also threatens to leak sensitive data to force payment. In such scenarios, the threat of publication is used as primary leverage to coerce the victim into paying a ransom.

While the specific details regarding this group's operations are limited in public information, the incident highlights the ongoing risks faced by large organizations. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining strict access controls, and ensuring comprehensive logging and monitoring to detect unauthorized data movement. Organizations should also prioritize regular data backups and incident response planning to manage the fallout of a potential breach.