Samuel Sekuritas Indonesia and Samuel Aset Manajemen targeted by Trigona ransomware group

• Ransomware group: Trigona
• Country: Indonesia
• Sector: Financial Services
• Announcement date: January 18, 2024

Trigona ransomware group claims data breach at Samuel Sekuritas Indonesia and Samuel Aset Manajemen

The Trigona ransomware group has published an announcement on its leak site, claiming to have successfully exfiltrated data from two prominent Indonesian financial institutions: Samuel Sekuritas Indonesia and Samuel Aset Manajemen. The threat actor alleges that the breach occurred on January 18, 2024, and has subsequently posted a notice regarding the stolen information.

Details of the alleged attack and ransom demand

According to the announcement made by the Trigona group on January 18, 2024, the attackers claim to have compromised the systems of both Samuel Sekuritas Indonesia and Samuel Aset Manajemen. The group asserts that they have gained access to approximately 600 GB of data belonging to the organizations. To facilitate the return of this information, the group is demanding a ransom payment of 100,000 USD.

To support their claims of a successful intrusion, the group has provided screenshots. These images reportedly display various internal file directories and individual client account opening forms, which the attackers use to demonstrate the sensitivity of the information they have allegedly obtained.

Scope of the compromised data

The information released by the Trigona group suggests a significant exposure of sensitive corporate and client-related documentation. Based on the screenshots provided by the attackers, the data allegedly includes a variety of high-value files. The specific types of data identified in the leak include:

• Client identity information
• Client account opening forms
• Risk management reports
• Internal project files
• Video recordings

The presence of identity cards (KTP) and account opening forms indicates that the breach may have targeted personally identifiable information (PII) essential to the financial operations of the affected firms.

About Samuel Sekuritas Indonesia and Samuel Aset Manajemen

Samuel Sekuritas Indonesia and Samuel Aset Manajemen are investment banking and financial advisory firms based in Jakarta. Established in 1992, these institutions provide a wide range of financial services to both institutional and retail clients.

Potential impact and industry implications

This alleged breach carries significant implications for the affected institutions and their clientele. For the clients of these financial services firms, the exposure of identity cards and account forms may increase the risk of identity theft and financial fraud. Furthermore, because the organizations operate within the financial services sector, the leak of such data could lead to legal consequences under Indonesian data protection regulations.

The Trigona group typically employs double extortion tactics. In this model, attackers do not merely encrypt an organization's data to disrupt operations; they also threaten to publicly disclose the stolen information to exert maximum pressure on the victim to pay the ransom. This approach can lead to severe negative impacts on an institution's operational continuity and can cause a significant loss of client trust.

While public information regarding the specific operations and methods of the Trigona group remains limited, this incident highlights the ongoing risks faced by the financial sector. Organizations in this sector often implement defensive measures such as robust encryption, multi-factor authentication, and continuous monitoring to mitigate such threats. However, the threat of public disclosure remains a primary driver for ransomware groups targeting data-sensitive industries.