WalletKu Indompet Indonesia targeted by Killsec ransomware group

• Ransomware group: Killsec
• Country: Indonesia
• Sector: Technology
• Announcement date: September 28, 2025

Killsec claims to have breached WalletKu Indompet Indonesia

The threat actor known as Killsec has published an announcement on their dedicated leak site, claiming to possess sensitive data belonging to WalletKu Indompet Indonesia. This claim suggests a significant security compromise involving the digital payment and lifestyle platform. According to the announcement, the group has established a countdown timer and specific communication channels, which are standard procedures used to initiate a negotiation process with the targeted company.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. In many modern cyberattacks, threat actors utilize these sites to showcase proof of the breach, often including screenshots or samples of stolen information to validate their claims. By setting timers, these groups create a sense of urgency, hoping to coerce the victim into meeting their demands before the data is released to the public or sold to other malicious actors.

Details of the alleged data exposure

The announcement made by Killsec includes visual samples that appear to contain highly sensitive personal information. These samples indicate that the breach may have compromised critical identity documents used by the institution's users. The presence of such data in the hands of a threat actor significantly increases the risk of subsequent exploitation.

The specific types of data identified in the claim include:

• Personal identification data
• Tax identification data

The visual evidence provided by the group reportedly includes images of national identity cards (KTP) and tax identification documents (NPWP). The exposure of these specific documents is particularly dangerous, as they are foundational to an individual's legal and financial identity.

About WalletKu Indompet Indonesia

WalletKu is an Indonesia-based digital wallet and payment services platform. It provides users with digital solutions for various financial needs, including bill payments, mobile top-ups, and a wide range of other financial transactions. As a provider of digital payment and lifestyle services, the platform handles a significant volume of sensitive user information necessary for processing transactions and verifying identities.

Potential risks and organizational implications

This alleged breach poses a severe risk of exposure for the sensitive identity data belonging to the institution's users. When such data is leaked, individuals may be subjected to identity theft and highly targeted phishing attacks. Criminals can use the stolen identity and tax information to impersonate victims, open fraudulent accounts, or conduct sophisticated social engineering campaigns designed to extract even more information or funds.

Furthermore, the publication of this data may lead to significant legal and regulatory consequences. Under Indonesian data protection regulations, the institution may face legal liabilities, which could result in administrative sanctions. Organizations in the financial and technology sectors must be prepared to fulfill their data breach notification obligations and inform affected users promptly to mitigate damage.

The nature of the threat actor also adds a layer of complexity to this incident. Killsec has hacktivist origins but has shifted toward ransomware activities. This evolution in their tactics means there is a possibility that the group may employ secondary extortion tactics. Secondary extortion occurs when, even if a ransom is paid to decrypt data, the attackers threaten to leak the data anyway or demand additional payments to prevent its release.

For organizations operating in the digital payment sector, maintaining robust security postures is essential. This includes implementing strong encryption for data at rest and in transit, enforcing multi-factor authentication, and conducting regular security audits. Additionally, having a well-defined incident response plan is crucial for managing the legal, regulatory, and reputational fallout that follows a confirmed data breach.