Indonesia Infrastructure Guarantee Fund Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, the Indonesia Infrastructure Guarantee Fund was listed on a leak site operated by the Avaddon ransomware group. The listing indicated that internal files had been taken during a ransomware incident. No figure for the number of individuals affected has been released, and the organization has not confirmed the scope or contents of any exfiltrated material. This development reflects a pattern in which ransomware operators publish victim names and sample data to increase pressure for payment. Such listings have become a standard element of extortion campaigns targeting both public and private entities.

Inside the incident

The available information is limited to the public listing itself. The Avaddon group claims to have stolen internal data from the Indonesia Infrastructure Guarantee Fund and placed the organization on its leak site on the reported date. No independent confirmation of the volume of data, the method of initial access, or whether files were subsequently published has been made public. The number of records involved and the precise timing of any intrusion remain undisclosed.

Who is avaddon?

Avaddon is a ransomware operation that surfaced in 2020 and employed a double-extortion model. The group encrypted systems and separately threatened to release stolen files on a dedicated leak site if a ransom demand was not met. It targeted organizations across multiple countries and sectors, following tactics seen in other ransomware groups that combine encryption with data exposure. Public reporting on Avaddon ceased after mid-2021 when its infrastructure went offline, though the group’s prior activity established the pattern of publishing victim names to encourage payment negotiations.

Indonesia Infrastructure Guarantee Fund and its sector

The Indonesia Infrastructure Guarantee Fund operates as a state-linked entity that provides guarantees for infrastructure projects. Organizations of this type routinely handle project documentation, financial agreements, contractor information, and internal administrative records. A breach at such an institution can expose details tied to government-backed initiatives and the parties involved in large-scale construction and financing arrangements.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been released. Entities in this sector commonly maintain financial instruments, contract details, employee records, and correspondence related to project approvals. Without further disclosure from the organization or verified publication of the material, the exact contents cannot be confirmed.

What's at stake

Exposure of internal files from an infrastructure guarantee body could reveal commercial terms, project partners, and operational procedures. Individuals whose information appears in those files may face risks of targeted fraud or misuse of personal details. For the organization, the incident raises questions about the protection of sensitive project data and the potential for secondary operational or reputational effects if material is later released.

Were you affected?

Individuals who have conducted business with the Indonesia Infrastructure Guarantee Fund or similar entities should monitor their financial accounts and official correspondence for unusual activity. Checking whether an email address appears in known breach datasets through a free exposure scan provides one practical starting point. Organizations in comparable sectors are advised to review access controls and incident response procedures in light of ongoing ransomware activity.

AICompiled with AI assistance from public sources and published under our editorial standards.