MYINDIHOME TELKOM INDONESIA Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target telecommunications and internet service providers worldwide, exploiting the high value of operational data and customer records these organisations hold. In this landscape of double-extortion attacks, where data is stolen before systems are encrypted, claims of breaches surface regularly on criminal leak sites, often with limited independent verification.

On 28 January 2025, the ransomware group known as babuk2 listed MYINDIHOME TELKOM INDONESIA among its claimed victims. Public detail on the incident remains limited, with the number of people affected unknown and only a general reference to internal files said to have been taken. The listing itself is a claim by the group rather than a confirmed event, yet it warrants attention because of the organisation’s role in Indonesia’s digital infrastructure and the potential sensitivity of any material involved.

Breaking down the breach

According to available records, MYINDIHOME TELKOM INDONESIA was listed by the babuk2 ransomware group on 28 January 2025. The report characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No further specifics have been disclosed: the exact timing of any intrusion, the method of initial access, the volume of data taken, or confirmation that encryption or other disruptive actions occurred are all unconfirmed. The number of individuals potentially affected is listed as unknown. Beyond the group’s claim on its leak site, independent corroboration of the full scope has not been made public.

Inside babuk2

Babuk2 is associated with the broader Babuk ransomware family, a group that has operated since around 2021 and is known for double-extortion tactics. In such operations, attackers typically gain network access, steal data, and then deploy ransomware while threatening to publish the stolen material if a ransom is not paid. The group has historically used dedicated leak sites to name victims and, in some cases, release samples or full archives of claimed data. Public reporting has linked Babuk and its variants to attacks across multiple sectors, including manufacturing, logistics and professional services, often focusing on organisations with valuable proprietary or customer information. In this instance, the listing of MYINDIHOME TELKOM INDONESIA constitutes a claim by the group; no additional statements or proof packages specific to this victim have been detailed in the available facts.

About MYINDIHOME TELKOM INDONESIA

MYINDIHOME is the consumer broadband and digital services brand of Telkom Indonesia, the country’s largest telecommunications provider. It supplies fixed-line internet, IPTV, and related connectivity products to residential and small-business customers across Indonesia. As part of a major national telecom operator, the organisation manages extensive network infrastructure, customer account systems, and internal operational records. A breach involving such an entity is consequential because telecommunications providers sit at the centre of everyday digital life; any compromise can affect service reliability, customer trust, and the security of personal and billing information that these companies routinely process. Even when only internal files are referenced, the potential reach into operational or subscriber-related material raises legitimate concern for both the company and the public it serves.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No more precise inventory of data types—such as customer databases, employee records, network configurations, or financial documents—has been disclosed. Organisations of this kind typically hold subscriber account details, contact information, service usage records, payment data, and a range of internal technical and administrative files. Because the exact contents remain unconfirmed, it is not possible to state with certainty what material, if any, left the organisation’s control. The description is limited to the general claim of internal-file exfiltration.

What's at stake

For individuals, the primary risks centre on the possibility that personal or account-related information could later appear in criminal marketplaces, enabling phishing, identity misuse, or targeted fraud. Even if only internal operational files were taken, those materials can sometimes contain credentials, network maps, or customer-related notes that facilitate further attacks. For the organisation, the stakes include potential regulatory scrutiny, reputational damage, and the cost of investigation and remediation. Service continuity and customer confidence may also be affected if the incident proves more extensive than currently reported. Because the scale and precise contents are unknown, the concrete impact cannot yet be quantified; the situation simply underscores the ongoing exposure that large connectivity providers face.

What to do if you're exposed

Anyone who holds an account with MYINDIHOME or related Telkom Indonesia services should monitor statements for official updates and change passwords on any accounts that reuse the same credentials. Enable multi-factor authentication where available, watch for unexpected login alerts or billing anomalies, and treat unsolicited messages requesting personal details with caution. As a practical first step, readers can run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. If any personal data is later confirmed to have been involved, consider placing fraud alerts with relevant credit or identity-protection services and reviewing account activity regularly.

AICompiled with AI assistance from public sources and published under our editorial standards.