Triple X ransomware group lists Bni.co.id bank of indonesia free data. on its leak site

• Ransomware group: Triple X
• Country: Indonesia
• Sector: Financial Services
• Announcement date: June 13, 2026

Triple X claims a massive data breach at Bni.co.id

The threat actor known as Triple X has published an announcement on its dedicated leak site, claiming to have successfully exfiltrated a significant amount of data belonging to Bni.co.id. According to the claims made by the group, the stolen information is part of a massive dataset totaling 2 TB in size. The group has indicated that a portion of this data has been made available via a public directory, while suggesting that interested parties should contact them to obtain the full dataset.

This type of announcement is a hallmark of modern ransomware operations, specifically those utilizing double extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive information to use as leverage. By threatening to release private data on public leak sites, attackers increase the pressure on organizations to comply with ransom demands to avoid reputational damage and regulatory penalties.

Details of the alleged data leak

The Triple X group alleges that the stolen information covers a specific timeframe, spanning from 2024 to 2026. The group's announcement suggests that the breach involves highly sensitive documentation that could be used for various malicious purposes. According to the information provided by the threat actor, the leaked files are organized into various parts within a directory structure, as evidenced by screenshots shared by the group.

The specific types of data the group claims to have obtained include:

• Customer contracts
• Passport information
• ID card information

The presence of such highly personal documentation in a leak is a critical security event. When identity documents like passports and ID cards are compromised, the risk to the individuals involved increases significantly. These documents are primary targets for cybercriminals looking to facilitate identity theft, unauthorized account access, or sophisticated social engineering attacks.

About Bank Negara Indonesia (BNI)

Bank Negara Indonesia (BNI) is an Indonesian state-owned commercial bank with an extensive branch network. The institution provides a wide range of banking, credit, and investment services to both individual and corporate clients. As a major player in the Indonesian financial sector, the bank maintains a significant presence in the regional economy through its diverse service offerings.

Potential risks and organizational implications

The alleged breach of Bni.co.id could pose a significant risk of identity theft and fraud for the institution's customers. The leaked passport and ID data could potentially be exploited for unauthorized access to financial accounts or targeted phishing campaigns. Furthermore, the institution may face legal scrutiny under Indonesian data protection regulations following such an incident.

The claim regarding potential security vulnerabilities within the institution's infrastructure might also attract further attention from other threat actors. In the current cyber threat landscape, once a vulnerability is exploited by one group, it often becomes a target for others. Information regarding the Triple X group remains limited, and their specific operational methods have not yet been fully analyzed by security researchers.

For organizations operating within the financial services sector, maintaining robust defensive postures is essential. Common defensive steps include implementing multi-factor authentication (MFA) across all services, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular security awareness training for employees. Additionally, organizations often employ advanced monitoring and detection tools to identify unauthorized data exfiltration attempts in real-time. As the threat landscape evolves, the ability to detect and respond to these types of data-centric attacks remains a top priority for financial institutions worldwide.