kominfo.go.id Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target government and public-sector organisations worldwide, using data theft and public leak-site listings as leverage. In this environment, claims of breaches against national ministries attract particular attention because of the sensitive information such bodies routinely handle and the potential knock-on effects for citizens and services.

On 20 June 2024, the Indonesian government domain kominfo.go.id was listed by the ransomware group babuk2. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further technical detail has not been disclosed. The listing itself is a claim by the group; independent confirmation of the full scope has not been made public.

Inside the incident

According to available records, kominfo.go.id appeared on babuk2’s leak site on or around 20 June 2024. The reported summary identifies the organisation simply as kominfo.go.id and states that internal files were exfiltrated during a ransomware attack. No public figure has been given for the volume of data taken, the precise date of initial access, or the number of individuals whose information may be involved. Methods of intrusion, any ransom demand, and whether systems were encrypted in addition to data theft have not been disclosed in the material available. The incident is therefore known primarily through the group’s listing and the high-level description of exfiltrated internal files.

The group behind it: babuk2

Babuk (sometimes referenced in later iterations as babuk2) is a ransomware operation that has been documented since 2021. Like many contemporary ransomware groups, it has employed a double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. Public reporting on Babuk has described attacks against a range of sectors, including government and critical infrastructure targets, with leak sites used to pressure victims. The group’s operators have historically advertised stolen data on dedicated sites and, in some cases, auctioned or released files. In the present matter, babuk2 claims to have listed kominfo.go.id and to have exfiltrated internal files; those claims should be treated as assertions by the threat actor rather than independently verified findings unless further confirmation emerges.

kominfo.go.id and its sector

kominfo.go.id is the online presence of Indonesia’s Ministry of Communication and Informatics (Kementerian Komunikasi dan Informatika). The ministry oversees national policy on telecommunications, broadcasting, information technology, and related public services. Organisations of this type typically manage internal administrative records, policy documents, correspondence, employee data, and information connected to regulatory or citizen-facing digital services. A ransomware incident affecting such a ministry is consequential because government digital infrastructure underpins public administration, and any compromise can raise questions about the confidentiality of official records and the continuity of services that citizens rely upon. The sector as a whole has been a recurring target for ransomware groups seeking high-impact leverage.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated in the ransomware attack. Exact contents, file counts, and whether personal data of citizens or staff were included have not been disclosed. Organisations in the communications and informatics ministry sector commonly hold internal policy papers, operational documents, staff records, and systems data. Without confirmation, it is not possible to state which of these categories, if any, were taken. The precise nature of the material therefore remains unconfirmed beyond the group’s claim of internal-file exfiltration.

The real-world impact

For individuals whose information may have been among the internal files, risks include potential misuse of personal or contact details, phishing attempts that reference official-looking material, and longer-term exposure if documents surface on criminal forums. For the organisation, consequences can include operational disruption, the cost of investigation and remediation, and the need to notify affected parties and regulators where required by law. Because the scale and exact contents remain unknown, the full extent of harm cannot yet be measured. Even limited internal documents can, however, provide attackers with insight useful for further social-engineering or secondary attacks.

Were you affected?

If you have had dealings with Indonesia’s Ministry of Communication and Informatics, or if you are a current or former staff member, treat any unexpected communications that reference official documents with caution. Practical first steps include:

• Monitor financial and email accounts for unusual activity.
• Enable multi-factor authentication on important services where available.
• Be alert to phishing messages that appear to come from government or ministry sources.
• Consider changing passwords on accounts that may have been linked to ministry systems.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this specific incident remains limited; further official statements from the ministry would be the most reliable source of updates.

AICompiled with AI assistance from public sources and published under our editorial standards.