Ransomware has hit some of Indonesia's most important institutions, from a state-owned bank to the national data centre. The lessons are valuable, but only if we are honest about the facts. In several of these cases the attackers made dramatic claims that the victims never confirmed, and in two the victims denied a breach entirely. Separating what is confirmed from what is alleged is the first discipline of good incident analysis, so that is how this article is written.
The five cases that defined the threat
The Indonesian companies and institutions named in publicly reported ransomware cases up to the end of 2024 are Bank Syariah Indonesia, the interim national data centre PDNS, Bank Indonesia, KAI, and Bank Rakyat Indonesia. The first three are incidents with documented disruption. The last two are leak-site listings that the named parties denied, and telling those two categories apart is the point of this page.
Click through the cases below. Each shows what is confirmed versus claimed, the likely root cause, and the control that would have changed the outcome.
The first three are well documented. Bank Syariah Indonesia suffered a multi-day outage of mobile, ATM, and branch services in May 2023, which the bank initially described as maintenance. LockBit claimed responsibility and said it had taken 1.5 terabytes covering around 15 million people, a figure the bank never confirmed. The most damaging detail is not the claim but the days of downtime for a major bank.
The national data centre incident in June 2024 is the clearest case. Brain Cipher ransomware, built on a leaked LockBit toolkit, disrupted around 210 government services including immigration and airport checks. The national cyber agency confirmed that only about 2 percent of the data had been backed up, which turned a containable incident into a national outage.
Bank Indonesia disclosed a Conti infection in January 2022. The central bank said about 16 computers at one branch were affected with no core data lost, while researchers reported a much wider spread. The gap between the two accounts is itself a lesson in how breach scope gets contested.
The last two are cautionary. The railway operator KAI was listed by the Stormous group in January 2024, which claimed credentials and demanded a ransom; KAI said it found no evidence of a leak from its systems. Bank Rakyat Indonesia was named by another group in December 2024, but the bank, the cyber agency, and the ministry all denied any breach. A listing on a leak site is not proof of a compromise.
Why the list of names stops at 2024
The named cases above stop in December 2024, while the volume of attacks against Indonesia rose after that. BSSN recorded 5.5 billion attacks across 2025 and a further 1.52 billion between 1 January and 15 April 2026, as we set out in Indonesia cyber attack statistics.
Those two facts do not conflict. A list of named cases grows from disclosure rather than from attack count, and in Indonesia victims more often deny or stay silent than confirm. So the gap between rising volume and a short list of names is best read as a reporting gap, not as a sign the attacks stopped. For readers looking for the most recent case, that is why this page does not add names without confirmation.
The common entry points
Across these cases and ransomware generally, the same handful of doors keep getting used.
Phishing remains the classic delivery method, as reported in the Bank Indonesia case. Stolen credentials used against an exposed VPN or remote desktop are now just as common, which is the entry point the attacker claimed for KAI. Unpatched internet-facing systems and weak or disabled endpoint protection complete the picture. At the national data centre, attackers reportedly disabled Windows Defender before deploying the ransomware, which points straight to an endpoint protection and monitoring gap.
The same pattern outside Indonesia
Readers often ask for international cases as a comparison, and their value is not in the size of the loss figures but in how similar the root causes are.
Colonial Pipeline in the United States shut down its fuel pipeline network for several days in May 2021 after a DarkSide attack. The entry point was a remote access account with no multi-factor authentication on it. CISA issued dedicated guidance after that incident, and its first recommendation is to require multi-factor authentication.
Change Healthcare in the United States saw weeks of disruption to prescription claims and healthcare payments in February 2024 after an ALPHV or BlackCat attack. CISA notes the healthcare sector as the one most commonly victimised by that group. The company paid a ransom, and paying did not restore operations quickly.
Set those beside the Indonesian cases and the pattern is plain. Remote access without multi-factor authentication is the same door that was claimed in the KAI case. Dependence on recovery is the same problem that made the national data centre incident so expensive. The size of the organisation and the country differ, the controls do not.
Breaking the attack chain
Ransomware does not happen in a single moment. It moves through stages, and defenders can break the chain at any one of them. You do not need a perfect defence. You need to stop the attacker before encryption.
Two stages deserve special attention for Indonesian organisations. Lateral movement is what turned single-host intrusions into estate-wide disasters, as when an infection spread from one bank branch to many cities. Network segmentation and least privilege contain that spread. And the final stage, encryption, only forces a ransom decision if you cannot restore. Immutable, offline, regularly tested backups are the single most important control, as the national data centre learned the hard way.
What they could have done
The controls that would have prevented or contained these incidents are not exotic. Phishing-resistant multi-factor authentication on email, VPN, and administrator accounts would have closed the most common entry points. Endpoint detection and response with tamper protection, watched by a round-the-clock monitoring team, would have caught the disabling of security tools. Timely patching reduces the exposed surface. Network segmentation stops the spread. And immutable offline backups remove the attacker's leverage entirely.
The pattern across every case is that the expensive part was never the ransom itself. It was the downtime, the lost trust, and the scramble to recover without backups. Prevention is far cheaper than any of those.
At Alpha Code, we help Indonesian organisations build the layered defences that turn a potential headline into a contained incident. That means a 24/7 SOC that catches attacker behaviour before encryption, and a tested incident response plan for when prevention is not enough. If you are not sure your backups would survive a ransomware attack, that is the conversation to start.
References
- Bank Syariah Indonesia outage and LockBit claim: BankInfoSecurity, The Jakarta Post (May 2023)
- PDNS Brain Cipher incident and BSSN confirmation: The Record, Tirto.id (June 2024)
- Bank Indonesia Conti disclosure: Kompas.com, CNBC Indonesia, VOI.id (January 2022)
- KAI listing by Stormous and KAI denial: Jakarta Globe, VOI.id (January 2024)
- BRI denial of Bashe claim: Jakarta Globe, Tempo.co, Komdigi statement (December 2024)
- CISA guidance issued after the Colonial Pipeline incident: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks (AA21-131A), CISA
- The group behind the Change Healthcare incident and the sector it most commonly victimises: #StopRansomware: ALPHV Blackcat (AA23-353A), CISA
- Attack volume for 2025 and 2026: Indonesia cyber attack statistics, sourced to BSSN and AwanPintar.id