MYINDIHOME TELKOM INDONESIA by ( Babuk Locker ) Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 28 January 2025 a ransomware group known as babuk2 listed MYINDIHOME TELKOM INDONESIA among the organisations whose internal files it claims to have taken. For customers and staff of Indonesia’s largest fixed-broadband provider, the practical question is straightforward: whether personal account details, service records or other internal material connected to them now sit outside the company’s control. Public information remains limited, yet the listing alone is enough to warrant careful attention from anyone who holds a MyIndiHome subscription or works with the service.

The number of people potentially affected is unknown, and the precise contents of the files have not been independently verified. What is known is that the group asserts it exfiltrated internal material during a ransomware attack. That claim, if accurate, places ordinary users in a position where they must decide how to protect themselves while official confirmation is still absent.

What happened

According to the listing published by babuk2, MYINDIHOME TELKOM INDONESIA was the target of a ransomware attack in which internal files were removed from the organisation’s systems. The report date is 28 January 2025. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been disclosed in the available record. The group’s leak-site entry simply names the organisation and states that internal files were exfiltrated. Whether the data has been released publicly, sold, or remains under the group’s control is not confirmed by independent sources.

Inside babuk2

Babuk2 is associated with the Babuk ransomware family, a group that first gained wide notice in 2021 for double-extortion operations. In the classic Babuk model, operators encrypt systems and simultaneously copy data, then threaten to publish or auction the stolen material if a ransom is not paid. The original Babuk source code was later leaked, allowing variants and successor operations to appear under related names. Public reporting has linked Babuk-linked actors to attacks on enterprises, logistics firms and public-sector bodies across several continents. Their typical pattern is opportunistic rather than highly targeted: once inside a network they move quickly to identify valuable file shares, compress and extract them, then deploy encryption. The listing of MYINDIHOME TELKOM INDONESIA follows that established pattern; the group claims responsibility for the intrusion and the removal of internal files, but offers no additional proof beyond the leak-site entry itself.

Who is MYINDIHOME TELKOM INDONESIA by ( Babuk Locker )?

MyIndiHome is the consumer broadband and digital-services brand of PT Telkom Indonesia, the country’s dominant fixed-line and fibre operator. The service supplies internet access, IPTV and related digital products to millions of households and small businesses across Indonesia. As a major telecommunications provider, the organisation routinely holds customer identity data, service-subscription records, billing information, network-configuration files and internal operational documents. A breach affecting such an entity is consequential because the same infrastructure that delivers everyday connectivity also stores the personal and contractual details of a large share of the national population. Even when only “internal files” are named, the potential for secondary exposure of customer-related material remains a legitimate concern.

What data was at risk

The only data type explicitly named in the available record is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, databases or record counts has been published. Organisations of this kind typically maintain customer account databases, authentication credentials, network diagrams, employee records and commercial contracts. Whether any of those categories were among the files taken has not been confirmed. Public detail is therefore limited to the group’s assertion that internal material left the network; the exact contents remain unconfirmed.

The real-world impact

For individuals, the principal risks are secondary misuse of any personal information that may have been included among the internal files—possible phishing, account-takeover attempts, or fraud that leverages knowledge of a subscriber’s service details. Because the number of people affected is unknown, the scale of that exposure cannot yet be measured. For the organisation, the incident raises operational and reputational questions: restoration of systems, potential regulatory scrutiny under Indonesia’s data-protection rules, and the need to communicate clearly with customers while facts are still incomplete. Neither the group nor the company has released verified figures on financial loss or service disruption, so those dimensions remain outside the public record.

Were you affected?

If you hold a MyIndiHome account or have supplied personal data to Telkom Indonesia services, treat the listing as a prompt for basic hygiene rather than proof of compromise. Practical first steps include:

• Change the password on your MyIndiHome portal and any linked email accounts, using a unique passphrase.
• Enable multi-factor authentication wherever the service offers it.
• Monitor bank and mobile-money statements for unexpected charges that could indicate credential misuse.
• Be alert to unsolicited messages that reference your broadband account or ask for one-time codes.
• Run a free exposure scan of your email address against known breach data sets to see whether it has already appeared in other incidents.

No public confirmation yet exists that customer records were among the files taken; the steps above remain useful regardless of the final scope of this particular event.

AICompiled with AI assistance from public sources and published under our editorial standards.