RansomHub ransomware group lists LPDB KUMKM LPDB.ID/LPDB.GO.ID on its leak site

• Ransomware group: RansomHub
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: May 14, 2024

RansomHub claims massive data leak against LPDB KUMKM

The RansomHub ransomware group has claimed responsibility for a significant data breach targeting LPDB KUMKM, an institution based in Indonesia. According to an announcement made on a leak site on May 14, 2024, the group alleges that they have successfully exfiltrated a vast amount of sensitive information, totaling approximately 15.48TB. This claim suggests a highly impactful breach aimed at a government-sector entity.

In modern cyberattacks, ransomware groups often employ a technique known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to demand a ransom for decryption; they also steal sensitive data beforehand. The threat of leaking this stolen information on public forums or specialized leak sites serves as additional leverage to pressure the victim into paying the ransom. This method significantly increases the pressure on organizations, as the exposure of data can lead to long-term reputational and legal consequences that far outweigh the immediate costs of system recovery.

Details of the alleged ransomware attack

The RansomHub group claims to have conducted a targeted ransomware attack against the institution. According to the group's announcement, the attackers managed to penetrate the network and encrypt various critical assets. Specifically, the group states that private documents, backups, and NAS storage units within the institution's network were targeted and encrypted during the operation.

The group's claim indicates that the breach was not limited to a single server but extended to networked storage solutions, which are often used for centralized data management. By targeting backups and NAS units, attackers aim to maximize disruption and increase the likelihood of a successful extortion attempt, as the loss of backups can severely hinder an organization's ability to restore systems through traditional means.

Scope of the alleged data exfiltration

The volume of the data allegedly stolen is substantial, with the group claiming a total of 15.48TB has been compromised. The leaked content is said to include various corporate documents that could impact the institution's operations and reputation. The specific types of data mentioned in the claim include:

• Corporate correspondence
• Project financial data
• User data

Furthermore, the group claims the stolen information contains internal correspondence, technical reports, project revenue projections, and CSV files containing user data. The presence of such diverse data types, ranging from technical documentation to financial projections and user-specific information, suggests a broad compromise of the institution's digital environment.

Impact and organizational implications

The scale of the alleged leak poses significant risks to the operational continuity of LPDB KUMKM. For government institutions, such breaches can lead to major disruptions in public services and the exposure of sensitive government data. Such incidents often trigger complex legal obligations under national data protection regulations, as the institution may be required to report the breach and mitigate the impact on affected parties.

The exposure of this data creates potential opportunities for secondary crimes. Specifically, the publication of sensitive information can be used by malicious actors to facilitate identity theft or to launch highly targeted phishing attacks against both the institution's staff and the small businesses that the institution serves. This creates a ripple effect where the breach of a single government entity can jeopardize the security of many private entities within its ecosystem.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024, gaining prominence following the dissolution of the ALPHV group. While the group was highly active during that period, reports indicate that they ceased operations in early 2025. To defend against such threats, organizations in the government and defense sectors typically focus on robust backup strategies, strict network segmentation to protect NAS units, and comprehensive employee training to prevent initial access through phishing.