PT Asuransi Bintang Tbk Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

PT Asuransi Bintang Tbk appeared on a ransomware group's leak site on 9 September 2021. The listing indicated that internal files had been taken during a ransomware incident, though the number of people affected and the precise contents of any data remain undisclosed in public reporting. The incident fits a pattern seen across multiple industries in 2021, where operators combined encryption with the threat of publication to pressure victims. No independent confirmation of the volume or sensitivity of the material has been released by the company or investigators.

What happened

PT Asuransi Bintang Tbk was listed on the Avaddon ransomware group's leak site on 9 September 2021. The group stated that it had exfiltrated internal files during a ransomware operation against the company. No further details on the timing of the intrusion, the method of initial access, or the scale of the data taken have been made public.

Inside avaddon

Avaddon operated as a ransomware-as-a-service group from mid-2020 through 2021. Its model involved affiliates deploying the ransomware and, when payment was not received, publishing samples of stolen material on a dedicated leak site to increase pressure. The group targeted organisations in multiple countries and sectors before its infrastructure was disrupted in 2021.

PT Asuransi Bintang Tbk and its sector

PT Asuransi Bintang Tbk is an Indonesian insurance company offering general insurance products. Organisations of this type routinely process policyholder records, claims documentation, financial details and internal operational files. A breach at an insurer can expose data that remains valuable for extended periods because insurance records often contain stable personal and financial identifiers.

The information in question

The only description provided is that internal files were taken. The exact categories of data, file counts or any indication of personal information have not been disclosed. Insurers typically hold names, addresses, identification numbers, policy terms and payment records, but it is not confirmed whether any of these were among the material referenced in the listing.

What's at stake

Individuals whose records appear in insurance systems can face risks of identity misuse or targeted fraud if the data later circulates. For the organisation, the incident adds to operational costs, regulatory scrutiny and potential loss of customer trust. Because the number of people affected is unknown, the full scope of downstream consequences cannot yet be measured.

What to do if you're exposed

Monitor bank and insurance statements for unusual activity and consider placing fraud alerts with credit agencies where available. Use strong, unique passwords and enable multi-factor authentication on any accounts linked to the insurer. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.