Ransomware response in Indonesia: what to do in the first 72 hours

When ransomware encrypts your systems, every minute has a cost. Companies without a written response plan take on average two to three times longer to recover than those that have one. In Indonesia, the pressure is layered: alongside halted operations, UU PDP reporting obligations start running from the moment the incident becomes known.

This page explains what to do in the first 72 hours, when and to whom you are required to report, and how to decide whether an incident response retainer fits your organisation.

The first 72 hours that decide recovery

Ransomware response is not about heroics, it is about executing the right sequence of actions. The most common mistakes are either acting too quickly without understanding the scope of encryption first, or hesitating to investigate while encryption is still running.

1. 1

   0-2 hours: Isolate

   Disconnect infected systems from other network segments, disable Wi-Fi and VPN on affected devices, do not power off servers before the forensics team secures volatile memory, and disconnect backup systems from the production network.

2. 2

   2-6 hours: Assess

   Identify the ransomware variant from encrypted file extensions or the ransom note, verify that backups are isolated and untouched by encryption, and determine the initial entry point from available logs.

3. 3

   6-24 hours: Strategic decision

   With a clearer picture of scope, decide on a recovery path: restore from clean backup, negotiate with legal counsel, or a combination. Activate your business continuity plan for critical operations.

4. 4

   24-72 hours: Structured recovery

   Rebuild from clean, verified images rather than simply decrypting files. Patch the exploited entry vector before systems come back online. Monitor for lateral movement for the following 30 days.

Reporting obligations in Indonesia

Ransomware almost always involves data exfiltration before encryption, which means a personal data breach under UU PDP. Two different clocks apply, and they are often confused. The 3x24 hour notice comes from UU PDP Article 46 and covers personal data breaches. The 14-day figure that still circulates comes from Permenkominfo 20/2016, an older rule on written notice to data owners that predates UU PDP. Reporting to BSSN is a separate obligation entirely: it applies to operators of vital information infrastructure under Perpres 82/2022 and BSSN Regulation 1/2024, with its own 24-hour deadline.

Failing to report within the deadline is not just a fine risk. Regulators assess preparedness based on the speed and quality of your response, not only on the incident itself.

The real cost of ransomware in Indonesia

The ransom figure often gets the attention, but in major attacks on Indonesian companies it is usually not the largest cost.

Why to prepare before the incident

An incident response retainer is not insurance you hope never to use. It is a capability you pay to have ready when you need it.

What Alpha Code incident response includes

Our Incident Response service covers 24/7 active response from our Jakarta Security Operations Center, digital forensics, regulatory communications with BSSN and OJK, and structured recovery with verification.

For companies that have not yet responded to a major incident, we also run tabletop exercises, simulated incidents that test your response plan before a real crisis, so your team knows exactly what to do and who to notify.