dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 18, 2025, the ransomware group known as babuk2 listed dukcapil.kemendagri.go.id — associated with SIAK DUKCAPIL under Indonesia’s Ministry of Home Affairs — on its leak site. The listing asserts that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail on the incident is limited to this claim and the named data category.

The listing concerns a core government system for population and civil registration. Any confirmed compromise of such infrastructure would carry implications for citizens whose records are administered through it, though the precise scope and verification of the claim have not been publicly established.

Breaking down the breach

According to the available record, babuk2 listed the domain dukcapil.kemendagri.go.id, identified as SIAK DUKCAPIL of the Ministry of Home Affairs of Indonesia, on March 18, 2025. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details — such as the initial access method, the volume of data taken, encryption status of systems, or any ransom demand — have been disclosed in the public facts. The number of individuals potentially affected is listed as unknown. The listing itself constitutes an unverified claim by the group; independent confirmation of the intrusion or the data release has not been provided in the given record.

Inside babuk2

Babuk2 operates in the style of ransomware groups that combine encryption of victim systems with data exfiltration, then pressure organisations by threatening or carrying out public release of stolen material on dedicated leak sites. Public reporting on the broader Babuk lineage has documented use of double-extortion tactics, in which operators first steal files and later deploy ransomware, followed by timed publication of samples or full archives if negotiations fail. Successors and rebranded variants of earlier Babuk activity have continued similar patterns of victim listing and data dumping. For this specific incident, the only assertion tied to the Ministry of Home Affairs is the group’s own leak-site claim of internal-file exfiltration; no additional statements by babuk2 about this victim appear in the facts.

Who is Ministry of Home Affairs of Indonesia?

The Ministry of Home Affairs of Indonesia is the central government body responsible for domestic governance, regional administration, and population affairs. Within it, the Directorate General of Population and Civil Registration (DUKCAPIL) operates SIAK, the national population administration information system. Organisations of this type typically maintain large-scale civil registries that include identity documents, demographic records, family data, and related administrative files used for public services, elections, and social programmes. A breach affecting such a ministry is consequential because the data under its control often forms the authoritative record of citizenship and personal status for tens of millions of people, making any unauthorised access or leakage a matter of national-scale privacy and security concern.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory — file names, databases, or specific record types — has been disclosed. Organisations administering national civil-registration systems commonly hold identity numbers, names, dates of birth, addresses, family relationships, biometric or photographic data, and supporting administrative documents. Whether any of those categories were among the files claimed by babuk2 remains unconfirmed. Public detail is limited to the group’s assertion of internal-file theft; exact contents cannot be stated as fact.

Why it matters

If the claimed exfiltration is accurate, affected individuals could face elevated risks of identity misuse, targeted fraud, or social-engineering attacks that rely on accurate personal details. For the ministry, exposure of internal files may complicate ongoing administrative operations, require costly system remediation, and erode public confidence in the security of civil-registration services. Because the scale of impact is unknown and the data types beyond “internal files” are unconfirmed, the concrete harm cannot yet be quantified, yet the sensitivity of population-administration systems means even limited leakage warrants careful monitoring by both citizens and authorities.

Were you affected?

Public information does not identify specific individuals or provide a full data inventory, so it is not possible to confirm personal impact from the available record alone. Practical first steps include the following:

• Monitor official statements from the Ministry of Home Affairs or Indonesian cybersecurity authorities for any confirmed notices or guidance.
• Be alert to unexpected communications that reference personal details potentially drawn from civil-registration records.
• Review account security on government and financial services that rely on national identity data, and enable stronger authentication where available.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets.

If you later receive official notification that your records were involved, follow the instructions provided by the ministry or relevant data-protection body. Until further verified details emerge, treat the babuk2 listing as an unconfirmed claim and remain cautious with personal information.

AICompiled with AI assistance from public sources and published under our editorial standards.