Bank of Indonesia Listed by conti Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Bank of Indonesia Listed by conti Ransomware Group (reported January 20, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
On January 20, 2022, the Bank of Indonesia appeared on a leak site operated by the Conti ransomware group. The group claims to have exfiltrated internal files from the institution during a ransomware attack, though no confirmation of the incident or its scope has been issued by the bank itself.
The number of people affected is not known, and the specific contents of any exfiltrated material have not been disclosed. Public records contain no additional verified information about the method of access or the volume of data involved.
What happened
The only confirmed public record is the listing of Bank of Indonesia on the Conti leak site on the reported date. The entry states that internal files were taken. No further technical details, such as the initial access vector, encryption status, or timeline of the operation, have been made public.
Neither the scale of the claimed exfiltration nor any ransom demand or payment has been documented in available reporting. The organisation has not released an official statement confirming or denying the claims.
Who is conti?
Conti is a ransomware group that has conducted operations since at least 2020. It is known for deploying ransomware that both encrypts systems and exfiltrates data, a tactic often described as double extortion. The group has targeted organisations across multiple sectors and has maintained a leak site to publish data when ransom demands are not met.
Public reporting on Conti describes a ransomware-as-a-service model in which affiliates carry out intrusions while the core group supplies tools and infrastructure. The listing of Bank of Indonesia follows the pattern the group has used with other claimed victims, though the accuracy of any individual claim remains unverified by independent sources.
About Bank of Indonesia
Bank of Indonesia is the central bank of Indonesia. Its responsibilities include formulating monetary policy, overseeing the national payment system, and supervising commercial banks. Central banks routinely hold records related to financial stability, regulatory oversight, and internal operations that are not intended for public release.
Because of its role at the centre of the financial system, any confirmed compromise of its internal systems would carry implications beyond the immediate organisation, affecting confidence in payment infrastructure and regulatory processes.
What was likely exposed
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, categories, or record counts has been published. The exact data therefore remain undisclosed.
Organisations of this type commonly maintain internal documents on regulatory examinations, interbank communications, employee records, and operational procedures. Without confirmation, it is not possible to determine whether any of these categories were among the claimed files.
Why it matters
Even without Reported Details, the appearance of a central bank on a ransomware leak site raises the possibility that sensitive internal material could be released. Such material could include information that affects market operations or regulatory relationships.
For individuals whose data may be held by supervised institutions or by the central bank itself, the incident underscores the downstream risk that records collected for supervisory purposes could be exposed through upstream compromises.
If your data was in this claimed breach
Monitor bank and financial accounts for unusual activity and review any statements issued by Bank of Indonesia or Indonesian financial regulators. Enable multi-factor authentication on accounts that support it and change passwords for services that may share credentials with affected systems.
Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public records of incidents such as this one.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Lowell Listed by conti Ransomware GroupBANQUE CENTRALE DE TUNISIE Listed by conti Ransomware GroupEbix Inc. Listed by conti Ransomware GroupRheinland-Pfalz Bank Listed by conti Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Bank of Indonesia Listed by conti Ransomware Group →
Publicly posted by conti — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.