Log in Request a demo

Significant cyber incident

PDNS 2 national data center ransomware attack, Indonesia, 2024

The PDNS 2 national data center ransomware attack on 20 June 2024 disrupted Indonesia's Temporary National Data Center 2 in Surabaya, which hosts central and local government systems.

In short

The PDNS 2 national data center ransomware attack on 20 June 2024 disrupted Indonesia's Temporary National Data Center 2 in Surabaya, which hosts central and local government systems. The BSSN, the national cyber agency, said the ransomware was Brain Cipher, the latest development of LockBit 3.0, and the attackers asked for 8 million US dollars. The ministry counted 239 institutions disrupted.

Last updated October 2026

What happened

The communications minister told parliament that the first disruption at PDNS 2 in Surabaya was detected on 17 June 2024. He said an attempt to switch off Windows Defender was found from about 23:15 that evening. On 20 June at 00:54 malicious activity began: malicious files were installed, key system files deleted and running services switched off (Antara, 27 June 2024).

Public services failed that day. Reuters reported that the attack disrupted immigration checks at airports, with long lines at immigration desks (Reuters, 24 June 2024). On 24 June the BSSN head told reporters that the cause was a new ransomware called Brain Cipher, the latest development of LockBit 3.0. The minister said the attackers asked for 8 million US dollars, about 131 billion rupiah.

The number of affected bodies changed during the week. The government first identified 211 institutions on 24 June and 282 on 25 June. On 27 June the minister gave 239 institutions as disrupted and 43 as unaffected, because their data sat at PDNS 2 only as a backup copy.

The BSSN head told parliament on 27 June that there was no backup of the PDNS 2 data, and that only about 2 percent had been copied to the national data center in Batam. On 3 July the Brain Cipher group gave a code to unlock the encryption. The ministry said it opened its sample data and that it could not yet say whether it would work on all data.

Timeline

  1. 17 June 2024

    The first disruption at PDNS 2 in Surabaya is detected. An attempt to switch off Windows Defender is found from about 23:15.

  2. 20 June 2024

    Malicious activity begins at 00:54 and Windows Defender crashes at 00:55. Public services, including immigration checks at airports, are disrupted.

  3. 24 June 2024

    The BSSN head says the ransomware is Brain Cipher, the latest development of LockBit 3.0. The minister says the attackers asked for 8 million US dollars. The government identifies 211 affected institutions.

  4. 25 June 2024

    The government identifies 282 institutions as affected.

  5. 26 June 2024

    Five institutions serve the public again after migrating data. The ministry later gives 239 institutions as disrupted, as of this date.

  6. 27 June 2024

    The minister and the BSSN head attend a working meeting of Commission I of the House. The BSSN head says there was no backup and only about 2 percent of the data was copied to Batam. The minister says there is no sign of a data leak yet.

  7. 1 July 2024

    The coordinating minister says PDNS 2 services will recover by the end of July and that a hot site in Batam will serve as backup. The director general of applications and informatics gives notice of resignation orally.

  8. 3 July 2024

    At about 22:00 the Brain Cipher group gives a code to open the encryption.

  9. 4 July 2024

    The ministry says the code opened its sample data and it is unclear whether it works on all data. The director general confirms his resignation.

  10. 19 March 2025

    The Central Jakarta prosecutor says it is examining witnesses in an alleged corruption case over PDNS procurement and management, with state losses of more than 500 billion rupiah.

How the attack worked

The official accounts describe what happened on the system, not how the attackers first got in. The sources opened give no entry route, and the BSSN head said forensic work was limited because the evidence was itself encrypted. This page therefore describes only what the ministry and the BSSN stated.

Preparing the ground

The minister told parliament that an attempt to switch off the Windows Defender security feature was found from about 23:15 on 17 June 2024. At 00:55 on 20 June Windows Defender crashed and could not run.

Acting on the system

From 00:54 on 20 June the minister said malicious files were installed, key system files deleted and running services switched off. Services switched off is Service Stop (T1489).

Encrypting and demanding payment

The BSSN identified the tool as Brain Cipher ransomware, a development of LockBit 3.0. Ransomware that encrypts data is Data Encrypted for Impact (T1486). The attackers asked for 8 million US dollars. The sources opened do not state that a payment was made. On 3 July the group gave a code to unlock the data.

Why it spread so far

PDNS 2 hosted systems of many bodies. The BSSN head said the main problem was governance and the lack of backup, and that backup is required under BSSN Regulation 4 of 2021.

How the attack ran
  1. DetectedThe first disruption at PDNS 2 in Surabaya was detected on 17 June 2024, with an attempt to switch off Windows Defender from about 23:15
  2. Defenses failWindows Defender crashed at 00:55 on 20 June
  3. Malicious activityFrom 00:54 on 20 June malicious files were installed, key system files deleted and running services switched offTechnique T1489 (MITRE ATT&CK, opens in a new tab)
  4. Data encryptedBSSN identified Brain Cipher ransomware, a development of LockBit 3.0Technique T1486 (MITRE ATT&CK, opens in a new tab)
  5. Ransom demandedThe minister said the attackers asked for 8 million US dollars

Impact

Communications minister, 27 June 2024: 239 institutions using PDNS 2 were disrupted, as of 26 June: 30 ministries and agencies, 15 provinces, 148 districts and 48 cities. Another 43 were not affected because their data was only a backup copy at PDNS 2. He rated the impact critical and major.

Sources differ on the count: the government identified 211 institutions on 24 June and 282 on 25 June (Antara, 1 July 2024); MetroTV also reports 282 disrupted. The 282 matches 239 disrupted plus 43 unaffected.

Reuters, 24 June 2024: immigration checks at airports were disrupted, with long lines at immigration desks.

BSSN head, 27 June 2024: no backup of PDNS 2 data, about 2 percent copied to Batam.

The minister said on 27 June there was no sign and no proof yet of a data leak. Costs are not stated in the sources opened, apart from the ransom demand of 8 million US dollars (about 131 billion rupiah).

Government and regulator response

  • 24 June 2024: The BSSN, the communications ministry, police cyber crime and Telkom Sigma worked together on investigation and forensics. The ministry isolated the infected areas.
  • After the attack (date not given in the source): The President ordered the BPKP, the state finance and development audit body, to audit the governance of the national data center (MetroTV).
  • 27 June 2024: The minister and the BSSN head answered to Commission I of the House of Representatives.
  • 1 July 2024: The coordinating minister said the President wanted public services back to normal in July, and that backup would use a hot site in Batam.
  • 1 to 4 July 2024: The director general of applications and informatics resigned as moral responsibility for the disruption.
  • 3 to 4 July 2024: The ministry tested the code from the attackers on sample data.
  • 19 March 2025: The Central Jakarta prosecutor examined witnesses in an alleged corruption case over PDNS procurement and management.
  • 23 May 2025: The Central Jakarta prosecutor named five suspects in the alleged corruption case over PDNS procurement and management. The Attorney General’s Office page gives a project value of Rp958,485,181,470 from the 2020-2024 state budget.

Lessons

  1. Backups must exist outside the system they protect

    The BSSN head said there was no backup of PDNS 2 data and only about 2 percent was copied to Batam. A copy kept in the same place is not a backup.

  2. Concentration raises the stakes

    PDNS 2 hosted systems of 239 disrupted institutions, from ministries to city governments. One facility failed for many.

  3. Know your dependencies

    Immigration checks at airports were disrupted by the attack. Map which public or business services rely on one platform.

  4. Counts change in a crisis

    The affected number moved from 211 to 282 to 239 in a few days. Say what is confirmed and what is not.

  5. Rules only help if they are checked

    BSSN Regulation 4 of 2021 requires backup, yet the BSSN head found none. Audit compliance, not only policy.

  6. Paying or not is a decision to plan early

    The minister said the attackers wanted 8 million dollars. Agree in advance who decides and on what basis.

What to check in your own organization

  1. Backup copies

    Check that each critical system has a recent backup in another location that the same login cannot delete, and test a restore.

  2. Security tool tamper alerts

    Alert when endpoint protection such as Windows Defender is switched off or crashes. In this case it was disabled hours before the main activity.

  3. Service stops and file deletion

    Alert on mass service stops and deletion of system files on servers.

  4. Hosting dependencies

    List which of your services sit on shared hosting or a shared data center and what happens if it is encrypted.

  5. Recovery time

    Work out how long it takes to rebuild a platform from nothing. The government here targeted recovery by the end of July.

  6. Evidence handling

    Keep logs and images safe so that forensics are possible when data is encrypted.

  7. Contact with the national agency

    Know how to reach the BSSN or your sector regulator and what they expect in the first hours.

Questions

What happened to Indonesia's national data center?

A ransomware attack hit PDNS 2 in Surabaya from 20 June 2024. The BSSN said the ransomware was Brain Cipher, the latest development of LockBit 3.0.

How many institutions were affected?

The communications minister gave 239 institutions as disrupted and 43 as unaffected, as of 26 June 2024. Earlier counts were 211 and 282, so sources differ.

Did the government pay the ransom?

The attackers asked for 8 million US dollars. The sources opened do not state that anything was paid. On 3 July the group gave a code to open the data.

Was data stolen?

On 27 June 2024 the minister said there was no sign and no proof yet of a data leak.

Was there a backup?

The BSSN head said on 27 June 2024 there was no backup of PDNS 2 data, and only about 2 percent had been copied to Batam.

What happened afterwards?

The President ordered a BPKP audit of data center governance. In March 2025 prosecutors were examining witnesses in an alleged corruption case over PDNS procurement.

Sources

  1. Disruption at National Data Center caused by Brain Cipher ransomware (24 June 2024) ANTARA News
  2. Gangguan PDNS 2 akibat ransomware Braincipher (25 June 2024) ANTARA News
  3. Menkominfo jelaskan kronologi serangan siber PDNS 2 (27 June 2024) ANTARA News
  4. Cyber Attack Compromised Indonesia Data Centre, Ransom Sought (24 June 2024) Reuters via Kontan English
  5. Cyber attack compromised Indonesia data centre, ransom sought (24 June 2024) Reuters via Deccan Herald
  6. BSSN: Tak ada back up data pada PDNS 2 yang alami serangan siber (27 June 2024) ANTARA News
  7. Menko Hadi Tjahjanto pastikan PDNS 2 pulih pada Juli ini (1 July 2024) ANTARA News
  8. PDNS 2 to fully recover from cyberattack effects by July-end: Minister (1 July 2024) ANTARA News
  9. Kemenkominfo: Tim teknis upayakan buka kunci data PDNS 2 terenkripsi (4 July 2024) ANTARA News
  10. Dampak gangguan siber pada PDNS, Dirjen Aptika mengundurkan diri (4 July 2024) ANTARA News
  11. Menanti minta maaf BSSN dan Kemenkominfo atas kegagalan perlindungan data (28 June 2024) House of Representatives of Indonesia (DPR)
  12. Kejari Jakpus tetapkan 5 tersangka dugaan korupsi proyek PDNS senilai hampir Rp1 triliun (23 May 2025) Attorney General's Office of Indonesia (Kejaksaan)

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more