Badan Pengelola Keuangan Haji Listed by blackshrantac Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Badan Pengelola Keuangan Haji was listed by the blackshrantac ransomware group on November 29, 2025, after internal files were exfiltrated in a ransomware attack. The number of people affected has not been disclosed; anyone who has interacted with the agency should monitor their accounts and consider changing credentials.
What happened
The incident came to public notice through the group’s listing on November 29, 2025. The listing states that internal files were taken during a ransomware attack. No further details on the timing of the intrusion, the volume of data, or the method of access have been disclosed in the available record. The organization has not issued a public statement confirming or denying the claims.
The group behind it: blackshrantac
Blackshrantac is a ransomware operation that maintains a leak site where it lists organizations it claims to have targeted. The group’s typical pattern involves encrypting systems and exfiltrating data, then using the public listing to increase pressure on victims. The listing of Badan Pengelola Keuangan Haji constitutes the group’s claim; independent confirmation of the intrusion or the data taken has not been established in public reporting.
Who is Badan Pengelola Keuangan Haji?
Badan Pengelola Keuangan Haji is an Indonesian government agency based in Jakarta. Established under Law No. 34 of 2014, its mandate is to manage the financial aspects of the Hajj pilgrimage for Indonesian Muslims, including fund optimization, risk management, and ensuring participants’ financial obligations are met. The agency therefore holds records connected to large numbers of citizens preparing for or participating in the pilgrimage.
What data was at risk
The listing refers only to “internal files” without specifying their nature. The exact categories of information involved have not been disclosed. Organizations of this type routinely process personal identifiers, financial records, and pilgrimage-related documentation; however, whether any of those categories were among the files referenced remains unconfirmed.
Why it matters
Financial and identity information tied to a government-managed pilgrimage fund can affect individuals’ ability to plan travel, manage savings, and protect against fraud. For the agency, exposure of internal operational files could complicate ongoing financial oversight and regulatory compliance. The absence of Reported Details on the data limits precise assessment of individual risk at this stage.
Were you affected?
Individuals can begin by monitoring their bank accounts and official Hajj-related correspondence for unusual activity. Checking whether an email address appears in known public breach datasets through a free exposure scan provides one additional data point, though it will not cover files that have not yet surfaced publicly. Organizations in similar sectors are advised to review access logs and incident-response procedures even when direct confirmation of involvement is lacking.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
MultistateTax Inc Listed by blackshrantac Ransomware GroupCCI Tax Pros, Inc Listed by blackshrantac Ransomware GroupAl Ahly Leasing & Factoring Company Listed by blackshrantac Ransomware GroupAgrícola Cerro Prieto Listed by blackshrantac Ransomware GroupLatest breaches
Publicly posted by blackshrantac — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.