Astra Otoparts / PT. Inti Ganda Perdana Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 3 October 2025, the ransomware group known as thegentlemen listed Astra Otoparts, also referenced with its related entity PT. Inti Ganda Perdana, on its leak site. The group claims that internal files were exfiltrated in a ransomware attack against the Indonesia-based automotive-components manufacturer. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the incident has been independently verified beyond the listing itself.

The claim matters because Astra Otoparts operates as a publicly traded company (stock symbol AUTO.JK) that supplies automotive parts across domestic and international markets. Any confirmed exposure of internal files could affect business operations, partners and individuals whose data the company holds in the ordinary course of manufacturing and trading.

Breaking down the breach

According to the reported listing, thegentlemen claims responsibility for a ransomware attack in which internal files belonging to Astra Otoparts / PT. Inti Ganda Perdana were allegedly exfiltrated. The incident was reported on 3 October 2025. No public information has been released on the precise method of intrusion, the volume of data taken, the duration of any access, or whether systems were encrypted. The number of people affected is listed as unknown. The only concrete assertion available is the group’s claim that internal files were removed as part of the attack. All other operational details remain undisclosed.

Who is thegentlemen?

thegentlemen is a ransomware group that has appeared in public reporting as an operator of double-extortion campaigns. Like other groups of this type, it typically gains access to corporate networks, steals data, and then threatens to publish the material on a dedicated leak site unless a ransom is paid. The group’s listings are claims made by the actors themselves; they are not independent confirmations of a breach. Public knowledge of thegentlemen centres on its pattern of naming corporate victims and advertising stolen data rather than on any unique technical signature that has been formally attributed in this specific case. No statements attributed to thegentlemen about Astra Otoparts beyond the leak-site listing itself are part of the available facts.

About Astra Otoparts

Astra Otoparts is an Indonesia-based manufacturing company engaged in the trading of automotive components for domestic and international markets, including other Asian countries, the Middle East and Africa. It also manufactures metal parts, automotive components and plastics. Its stock trades under the symbol AUTO.JK. Public profiles associate it with a reported revenue figure of 20 billion USD and list related websites including www.astra-otoparts.com and http://www.igpgroup.astra.co.id. PT. Inti Ganda Perdana, named alongside it in the listing, mainly manufactures rear axles and propeller shafts. Organisations of this kind routinely hold supplier contracts, production data, employee records, customer orders and logistics information. A ransomware claim against such a firm is consequential because disruption or data exposure can affect supply chains that serve vehicle manufacturers and aftermarket networks across multiple regions.

The information in question

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, databases or personal-data fields has been disclosed. Manufacturing and trading companies of this scale typically maintain engineering drawings, procurement records, employee and contractor information, financial documents and customer correspondence. Because the exact contents remain unconfirmed, it is not possible to state what was taken beyond the group’s general claim of internal files. Readers should treat any more detailed descriptions circulating elsewhere as unverified unless corroborated by the company or independent investigators.

What's at stake

For individuals whose details may appear in the company’s systems—employees, contractors, suppliers or business contacts—the primary risks are identity misuse, targeted phishing and social-engineering attempts that reference the stolen material. For Astra Otoparts itself, the stakes include potential operational disruption, contractual liabilities to partners, regulatory scrutiny under Indonesian data-protection rules, and reputational damage if the claim is later substantiated. Because the scale of the alleged exfiltration is unknown, the concrete impact cannot yet be quantified. The absence of confirmed numbers does not eliminate the need for caution among those who have had dealings with the firm.

What to do if you're exposed

If you have a past or present relationship with Astra Otoparts or PT. Inti Ganda Perdana—whether as an employee, supplier or customer—treat the listing as a reason to take basic protective steps while awaiting further official information. Practical first actions include:

• Monitor bank and credit accounts for unfamiliar activity and enable transaction alerts where available.
• Change passwords on any accounts that reused credentials linked to work email or company portals, and enable multi-factor authentication.
• Be alert to phishing messages that reference automotive-parts orders, invoices or internal Astra Otoparts documents.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach data sets.
• Retain any official notices from the company and follow guidance issued by Indonesian authorities if they publish advice on this incident.

These measures do not confirm that your data was involved; they simply reduce the practical risk while the facts remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.