bri.co.id Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large financial institutions across Asia and beyond, using data theft and public leak-site listings as leverage. In this environment, claims of compromise against major banks raise immediate questions for customers and regulators about what may have been taken and how far the risk extends. On 18 December 2024, the domain bri.co.id appeared on a listing associated with the ransomware group known as apt73. Public detail remains limited, yet the claim itself is consequential because Bank Rakyat Indonesia is one of the country’s largest commercial banks and holds extensive customer and operational information.

What is known so far is that the group asserts it exfiltrated internal files in a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope has not been published. The listing therefore stands as an unverified claim that still warrants careful attention from anyone who banks with or works for the institution.

Breaking down the breach

According to the available record, bri.co.id was listed by the apt73 ransomware group on 18 December 2024. The reported summary describes Bank Rakyat Indonesia (BRI) as one of the largest commercial banks in Indonesia and notes that personal data and client-related material may be involved, though the public description is truncated. The only data category explicitly named is “internal files exfiltrated in a ransomware attack.” No figure for the volume of data, no list of specific file types beyond that phrase, and no confirmed count of affected individuals have been released. Timing of the initial intrusion, the method of entry, and whether encryption was also deployed remain undisclosed. In short, the public record consists of a leak-site claim of exfiltration rather than a fully documented forensic account.

The group behind it: apt73

apt73 is a ransomware operation that, like many contemporary groups, combines data theft with the threat of public release. Such actors typically gain access through phishing, compromised credentials or unpatched systems, move laterally, exfiltrate material they consider valuable, and then encrypt systems or simply threaten disclosure. Victims that do not pay are often named on dedicated leak sites, sometimes with sample files offered as proof. The listing of bri.co.id is therefore consistent with this pattern: the group claims to hold internal files and has chosen to publicise the organisation’s name. No independent verification of the volume or sensitivity of the material has been supplied in the public record, so the claim must be treated as an assertion by the threat actor rather than established fact. Prior activity by groups operating under similar monikers has focused on high-value targets in finance, government and critical infrastructure, but specifics of any earlier campaigns are not required to understand the present listing.

bri.co.id and its sector

Bank Rakyat Indonesia is a major commercial bank serving millions of retail, microfinance and corporate customers across Indonesia. Institutions of this scale routinely maintain customer identity records, account details, transaction histories, loan documentation, employee data and internal operational files. Because banking systems sit at the centre of personal finance and national economic activity, any credible claim of unauthorised access carries weight for depositors, borrowers and counterparties. A breach at this level can also attract regulatory scrutiny under Indonesia’s data-protection and financial-sector rules, even when the precise contents remain unconfirmed.

The information in question

The facts name only “internal files exfiltrated in a ransomware attack.” The accompanying summary alludes to personal data and client information but does not enumerate fields. Organisations of this kind typically hold names, national identity numbers, addresses, contact details, account numbers, transaction records and staff credentials. Whether any of those categories were among the files claimed by apt73 is unconfirmed. Public reporting has not released sample documents, row counts or a data inventory, so the exact contents must be regarded as unknown pending further disclosure by the bank or independent investigators.

The real-world impact

If internal files containing personal or client data were in fact taken, affected individuals could face risks of identity fraud, targeted phishing or unauthorised account activity. Even partial records can be combined with other leaked data sets to build more convincing social-engineering attacks. For the bank itself, the consequences may include customer notification obligations, forensic and remediation costs, potential regulatory inquiries and reputational pressure. Because the number of people affected remains unknown and the precise data types are unconfirmed, the scale of these risks cannot yet be quantified. The prudent stance is to treat the claim as a serious indicator that warrants monitoring rather than as proof of a fully mapped compromise.

If your data was in this claimed breach

Anyone who holds an account with Bank Rakyat Indonesia or has shared personal information with the bank should remain alert for unexpected communications that request credentials, one-time codes or payments. Enable multi-factor authentication where available, review recent account statements for unfamiliar activity, and consider placing fraud alerts with relevant credit or identity-monitoring services. Change passwords that may have been reused across banking and other sites. Because the full contents of the claimed exfiltration are not public, it is useful to check whether your email address has already appeared in other known breach collections; free exposure-scan tools can perform that check against aggregated historical data sets and provide an early warning if your details have surfaced elsewhere. Continue to follow official statements from the bank for any confirmed guidance or notification.

AICompiled with AI assistance from public sources and published under our editorial standards.