Quick links
Press Enter to search, Esc to close
Significant cyber incident
From 8 May 2023 customers of Bank Syariah Indonesia (BSI), the country's largest Islamic bank, could not use its mobile banking, ATMs and branches.
In short
From 8 May 2023 customers of Bank Syariah Indonesia (BSI), the country's largest Islamic bank, could not use its mobile banking, ATMs and branches. BSI first spoke of maintenance, then said it had found indications of a cyberattack. The LockBit ransomware group claimed to have stolen 1.5 terabytes of data. BSI and the authorities had not confirmed the theft in the sources opened.
On 8 May 2023 customers complained that the BSI mobile banking app was not working. BSI said the same day that the service was down because of system maintenance (Kontan, 8 May 2023). Antara reports that many customers found it hard to reach banking services from that Monday.
On 9 May BSI told the stock exchange that ATM and branch networks were restored. Kontan reported at about 08:00 on 11 May that a branch in Tangerang was still down. The Jakarta Post reported that, at a briefing on 11 May, the BSI chief executive said the bank had found indications of a cyberattack that disrupted all services from 8 May, and that all services had been recovered by 11 May. The two reports differ on how complete the recovery was by that morning.
On 13 May the Jakarta Post reported, citing a social media post by a monitoring account, that the LockBit ransomware group claimed to have stolen 1.5 terabytes of data from BSI. It said the group set a deadline of 4:09 a.m. on Tuesday 16 May. On 16 May BSI issued a statement after reports that LockBit 3.0 had released data on the dark web and that negotiations had not succeeded. BSI said it had coordinated with OJK, Bank Indonesia and BSSN and that data and funds stayed safe.
The sources opened do not confirm the size or content of any data theft. On 22 May the communications ministry said it was asking BSI for clarification and had obtained a data sample, which it was studying.
BSI mobile banking becomes unavailable. BSI says it is doing system maintenance. Customers report problems reaching banking services.
BSI tells the stock exchange that ATM and branch networks are restored. Mobile banking is restored in stages with basic features.
The BSI chief executive says that a cyber attack needs further proof through audit and digital forensics.
The BSI chief executive tells a briefing the bank found indications of a cyberattack. Kontan reports a Tangerang branch still disrupted at about 08:00.
A monitoring account posts that LockBit claims to hold 1.5 terabytes of BSI data (Jakarta Post).
The negotiation deadline set by the group falls at 4:09 a.m. BSI says it coordinated with OJK, Bank Indonesia and BSSN, and that data and funds are safe.
Police say they have received no specific report on the BSI case. Bank Indonesia says BSI has restored its connection and its payment services run normally.
The communications ministry says it is asking BSI for clarification and studying a data sample.
None of the sources opened describes how the attackers entered BSI’s systems or what they did inside. The BSI chief executive said on 10 May that a cyber attack needed further proof through audit and digital forensics. This page therefore sets out only what was said in public.
On 8 May BSI blamed system maintenance for the outage. By 11 May the chief executive said the bank had found indications of a cyberattack. The change in wording is part of the record.
The Jakarta Post reported that LockBit claimed to have stolen 1.5 terabytes of data, listing contact details, financial documents, card details and customer passwords, and gave the bank a deadline to negotiate. LockBit 3.0 is described by Antara as ransomware as a service. A monitoring account said the talks failed, and BSI answered that reports of a data release were circulating. BSI did not respond to the Jakarta Post about the group’s demands.
The sources opened contain no confirmation from BSI, the authorities or a forensic report of what data was taken. The communications ministry said on 22 May it had a sample and was studying it.
Claimed by the LockBit group, as reported by the Jakarta Post on 15 May 2023, citing a social media post of 13 May by a monitoring account. This is a claim by the group. The sources opened show no confirmation from BSI or an authority.
BSI stated on 16 May 2023 that it issued its statement after reports that LockBit 3.0 had released data; BSI did not itself confirm the identity of the attacker in the text opened.
No state attribution in the sources opened.
BSI customers could not use mobile banking, ATMs or branches from 8 May 2023 (Antara; Jakarta Post). BSI said on 9 May that ATM and branch networks were restored.
Sources differ on recovery: the Jakarta Post reported all services recovered as of 11 May, while Kontan reported a Tangerang branch still disrupted at about 08:00 that day.
Bank Indonesia, 17 May 2023: BSI had restored its connection and RTGS, national clearing and BI Fast ran normally.
LockBit claimed 1.5 terabytes of data (Jakarta Post). BSI said customer data and funds were safe. The size of any actual loss is not stated in the sources opened.
BSI first spoke of maintenance and later of indications of a cyberattack. Prepare a plain holding statement that does not guess the cause.
A group posted a claim and a deadline in public. Decide in advance who answers, and what is said, before the deadline falls.
Bank Indonesia checked that BSI's connection to national payment services was restored. Know which links to national systems you must bring back first.
BSI told customers never to share PIN, OTP or password. Leak claims bring scam calls.
Bank Indonesia said payment providers must restore services quickly after incidents. Know your sector's recovery duty.
Police said on 17 May they had no specific report. Decide who files a report with the authorities and when.
Check how long your channels (mobile, ATM, branch) take to restore, and in what order.
Keep approved wording for the first hours that does not name a cause until it is confirmed.
Check who monitors forums for claims against your name and who is told within the hour.
Be able to say what data sits where, so that a claim of 1.5 terabytes can be tested.
Prepare a customer notice on PIN, OTP and password scams for use after any incident.
Know the contacts at your financial regulator, central bank and national cyber agency.
Have a forensic firm or national agency route agreed, so audit and digital forensics can start at once.
From 8 May customers could not use mobile banking, ATMs or branches. BSI later said it had found indications of a cyberattack.
The Jakarta Post reported that the LockBit ransomware group claimed to hold 1.5 terabytes of BSI data. BSI had not confirmed the claim in the sources opened.
The sources opened do not confirm what data was taken. BSI said customer data and funds were safe. On 22 May the communications ministry was studying a data sample.
Sources differ. The Jakarta Post reported all services recovered as of 11 May. Kontan reported a Tangerang branch still disrupted at about 08:00 that day.
BSI said it coordinated with OJK, Bank Indonesia and BSSN. The communications ministry asked BSI for clarification on 22 May. Police said on 17 May they had no specific report.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.