PT Angkasa Pura I Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, PT Angkasa Pura I was listed on the leak site operated by the Avaddon ransomware group. The entry states that internal files were taken during a ransomware incident, though the scale of any exposure and the number of individuals affected have not been disclosed. The listing means that data held by an airport operator responsible for passenger processing and facility management in Indonesia may have left the organisation’s control. People who have flown through or worked at facilities managed by the company now face the possibility that records containing personal or operational details could circulate without confirmed limits on further distribution.

Breaking down the breach

The only confirmed public record is the September 9, 2021 listing itself. No official statement from PT Angkasa Pura I has detailed the date of the intrusion, the method of access, the volume of data taken, or whether encryption was also deployed. The group’s post asserts that files were exfiltrated, but independent verification of that claim has not been published.

Who is avaddon?

Avaddon operated as a ransomware-as-a-service group between 2020 and 2021. Its standard approach combined file encryption with the threat of publishing stolen material on a dedicated leak site if a ransom was not paid. The group listed dozens of organisations across multiple countries and sectors during its active period before its infrastructure was disrupted in mid-2021.

About PT Angkasa Pura I

PT Angkasa Pura I is a state-owned Indonesian enterprise that manages airports, including major facilities in eastern Indonesia. Organisations of this type maintain passenger manifests, identity documents presented at check-in, employee records, and operational systems that coordinate flights, security, and ground services. A compromise at such an operator can therefore touch both commercial aviation data and government-issued identification used by travellers.

What was likely exposed

The listing refers only to “internal files.” No inventory of specific data categories has been released by either the organisation or the group. Airport operators routinely process names, passport or national-identity numbers, ticket details, and contact information; however, whether any of these categories were among the claimed exfiltration remains unconfirmed.

Why it matters

Personal data held by airport authorities can be used for identity verification in other contexts, including banking, government services, and further travel. If the files contain such records, affected individuals could encounter attempts at account takeover or fraudulent applications. For the organisation, the incident adds to the operational and regulatory burden of responding to unauthorised access to systems that support critical transport infrastructure.

If your data was in this claimed breach

Begin by monitoring bank and government-service accounts for unusual activity and enable multi-factor authentication where available. Request copies of any personal data held by PT Angkasa Pura I through standard subject-access procedures. A free exposure scan of your email address against known breach repositories can indicate whether your information has already appeared in other public data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.