Indonesia

This page collects what official and public sources say about cyber threats to Indonesia. It uses advisories from CISA, statements from the Indonesian cyber agency BSSN and the ministries, state news agency reports, and Brandefense’s own research. Where Indonesian sources are cited, the quotes are in the original language.

Threat groups that official sources link to Indonesia

APT38: the US advisory AA20-239A (CISA, page last revised 24 October 2020) says North Korea’s BeagleBoyz bank-robbing team likely targeted financial institutions in a list of nations from 2015 through 2020, and the list includes Indonesia. The advisory says the team overlaps to varying degrees with groups known as Lazarus and APT38.

Lazarus Group: the same advisory names Lazarus among the groups the BeagleBoyz overlap with. It gives no Indonesian victim and no date for any Indonesian case, only the list of nations.

LockBit: after the June 2024 ransomware attack on the national data center (PDNS 2), the BSSN head and the communications minister (as reported by ANTARA News and Reuters) linked the attack to the Brain Cipher ransomware, which BSSN described as a newer version of LockBit 3.0. This is a ransomware family, not a state actor. No state attribution was given in the sources opened.

Incidents on record

This page lists only major incidents with national impact. Smaller incidents are left out.

How attackers target Indonesia: Brandefense research

Dark web and fraud. The Brandefense mid-year 2024 report on Indonesia says 58.8% of “Indonesia” mentions in dark web chats came in the second quarter of 2024, and that the most common post type was an organizational data leak. It shows a phishing page that mimics an Indonesian bank.

Ransomware and hacktivism. The same report says around 15 organizations in Indonesia were targeted by ransomware in the first half of 2024, and describes a DDoS attack tied to the OpIndonesia campaign. Its sector analysis rests on research into 10 active organizations in each selected sector. The matching Brandefense blog summary says botnet infections and third-party breaches affected the energy, telecommunications and defense sectors.

State-linked groups. The Brandefense post on the Lazarus group lists Indonesia among the countries where the group’s malware was spotted. The post on Ocean Lotus lists Indonesia among the countries named for that group.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

BSSN names Presidential Regulation 47 of 2023 on the National Cyber Security Strategy and Cyber Crisis Management as the national strategy. It also lists Law 1 of 2024 on Electronic Information and Transactions and Government Regulation 71 of 2019 on electronic systems and transactions. Presidential Regulation 82 of 2022 covers protection of vital information infrastructure. On 3 July 2024 the BSSN head said Indonesia had no dedicated cyber security law yet. On 29 June 2026 the government and Commission I of the House agreed to form a working committee for the Cyber Security and Resilience Bill, which is in the 2026 National Legislation Program and covers 10 matters.

How incident response is organized

BSSN is the national cyber agency. The communications ministry handled data leak cases during the transition to the new data protection law, and the cyber crime directorate of the national police (Bareskrim) investigates reports. In the financial sector, banks coordinate with the financial services authority OJK, Bank Indonesia and BSSN, as BSI said after its 2023 incident. After the 2024 data center attack the President ordered the BPKP, the state finance and development audit agency, to audit the governance of the national data center.

Sectors and rating

A BSSN deputy said on 8 May 2026 that banking is among the most mature sectors in digital security but is also a main target of attacks. The 2024 data center attack disrupted 239 institutions, according to the communications minister on 26 June 2024, and Reuters reported it disrupted immigration checks at airports. See the sector table on this page for sources.

Personal data

Law 27 of 2022 on Personal Data Protection was signed on 17 October 2022. It sets administrative sanctions from a written warning to fines, and criminal penalties of up to six years in prison and fines of up to 6 billion rupiah. On 4 February 2026 the ministry said the data protection agency was not yet formed and that the ministry supervised compliance meanwhile. On 22 July 2026 the government said it was finalizing the authority, which would work independently.

BSSN does publish counts of “traffic anomalies”, but not confirmed attack counts. A BSSN deputy said on 8 May 2026 that about 5.2 billion anomalies were found in 2025 and that an anomaly is not necessarily a cyber attack. Another deputy said on 23 April 2026 that 5.5 billion were recorded in 2025, so sources differ. BSSN also said its monitoring covers less than 10 percent of national internet traffic. Figures on attacks against Indonesian organizations will come from Brandefense Atlas.