pajak.go.id Listed by babuk2 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 18, 2025, the Indonesian tax authority website pajak.go.id was listed by the ransomware group known as babuk2. Public reporting indicates that the group claims to have carried out a ransomware attack involving the exfiltration of internal files. The number of people affected remains unknown, and further details about the scale or confirmation of the incident have not been disclosed in available records.

This listing places a central government tax service under scrutiny for potential data exposure. Because tax authorities handle sensitive personal and financial records as a core function, any claim of internal file theft raises practical questions for citizens and businesses that interact with the system, even while independent verification of the full scope stays limited.

Breaking down the breach

According to the reported information, pajak.go.id appears on a babuk2 leak-site listing dated March 18, 2025. The available summary states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the volume of data, the number of systems involved, or the precise date the intrusion began. The method of initial access, the duration of any dwell time inside the network, and whether encryption was deployed alongside theft are all undisclosed.

Ransomware incidents of this type typically involve unauthorized access followed by data copying and a demand for payment, after which the group may publish samples or full archives if negotiations fail. In this case the only concrete public assertion is the listing itself and the description of internal files having been taken. No confirmation from the organisation has been included in the source material, so the claim stands as an unverified allegation pending further official or independent reporting.

Who is babuk2?

Babuk2 is associated with the broader Babuk ransomware family, a group that has operated since at least 2021 and is known for double-extortion tactics. Publicly documented behaviour includes breaching networks, stealing data before or instead of encryption, and posting victim names on dedicated leak sites to pressure payment. Earlier campaigns attributed to Babuk and related variants have targeted organisations across multiple sectors, often focusing on entities holding large volumes of internal documents rather than purely consumer databases.

The group’s typical playbook involves initial access through common vectors such as compromised credentials or unpatched services, followed by lateral movement and selective exfiltration of files judged valuable for leverage. Leak-site postings are used as proof of access and as a countdown mechanism. In the present matter, babuk2’s listing of pajak.go.id constitutes a claim by the group; it does not by itself establish that the attack succeeded to the degree asserted or that any particular files have been released. No additional statements attributed specifically to this victim beyond the listing appear in the available facts.

pajak.go.id and its sector

pajak.go.id is the online presence of Indonesia’s Directorate General of Taxes, the national body responsible for tax administration, collection, and compliance. Organisations of this kind maintain systems that process taxpayer identification, returns, payments, audits, and related correspondence for individuals, companies, and other entities. As a government service, it sits at the intersection of public administration and financial oversight, making its digital infrastructure a high-value target for any actor seeking sensitive administrative material.

Tax authorities routinely hold records that link personal identity data with financial activity. A successful intrusion into such an environment can therefore affect not only the agency’s operational continuity but also the confidentiality of information submitted by millions of taxpayers. Even when the precise contents of an alleged breach remain unconfirmed, the sector’s role in national revenue systems means that any credible claim of internal-file exfiltration carries wider implications for public trust and for the security of related government platforms.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or record counts has been provided. The number of people potentially affected is listed as unknown.

Organisations in the tax sector typically store documents and structured data that may include taxpayer names, identification numbers, addresses, income details, bank or payment information, correspondence, and internal administrative records. Whether any of those categories were among the files claimed by babuk2 cannot be confirmed from the available information. Public detail is limited to the general description of internal files; exact contents remain unconfirmed and should not be assumed.

Why it matters

If internal files from a tax authority have been copied by an unauthorised party, the practical risks include potential misuse of personal or financial details for fraud, identity theft, or targeted social-engineering attempts against taxpayers and staff. Even partial exposure of administrative documents can reveal operational practices or contact information that adversaries later exploit. For the organisation itself, the incident—if verified—could disrupt services, require costly remediation, and erode confidence in the security of digital tax filing and payment channels.

Because the scale remains unknown and the listing is an unconfirmed claim, the immediate impact on any individual cannot be quantified. Still, the combination of ransomware tactics and a government tax service means that affected parties may face long-term monitoring needs rather than a single, contained event. Concrete harm depends on what was actually taken and whether it is later published or sold; those outcomes are not yet established in public reporting.

What to do if you're exposed

Anyone who has submitted tax returns, payments, or personal details through pajak.go.id should treat the situation with measured caution. Monitor bank and credit accounts for unexpected activity, enable multi-factor authentication on financial and government portals where available, and be alert to unsolicited messages that reference tax matters or request credentials. Consider placing fraud alerts with relevant credit or identity services if you believe your data may have been involved.

Because the precise contents of any exfiltrated files are unconfirmed, there is no definitive list of affected individuals. Readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan provides one additional data point and does not replace official guidance from the tax authority or law-enforcement channels should further details emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.