Telkom Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 29, 2020, the ransomware group revil listed Telkom on its leak site. The group claims to have stolen internal data from the organisation during a ransomware attack. The number of people affected is not known, and no further details on the volume or contents of any exfiltrated material have been made public. The listing means that records held by a telecommunications provider entered a public claims process operated by the threat actor. Individuals connected to Telkom, whether as customers or staff, face the possibility that information they supplied in the course of normal business may now circulate beyond the company’s control.

Inside the incident

Public reporting on the event is limited to the appearance of Telkom on the revil leak site on 29 May 2020. The group states that internal files were taken. No confirmation of the claim, no description of the access method, and no figure for the quantity of data have been released by either the organisation or independent investigators. The scale of any operational disruption inside Telkom also remains undisclosed.

Inside revil

Revil, also tracked publicly as Sodinokibi, operated a ransomware-as-a-service model in which affiliate groups deployed the malware and shared proceeds with the core developers. The group maintained a dedicated leak site on which it listed organisations that had not met its payment demands. Listings on the site were presented by the operators as proof that data had been removed prior to encryption. The same infrastructure had previously been used against companies in multiple sectors, with the operators publishing file samples to increase pressure on listed victims.

Telkom and its sector

Telkom provides telecommunications services, including fixed-line, mobile and data connectivity. Organisations of this type maintain large volumes of records generated through customer registration, billing, network management and service provisioning. A claim that internal files have been removed therefore touches both the company’s own administrative systems and any data it holds on behalf of subscribers.

The information in question

The only detail released is that internal files were allegedly exfiltrated. No inventory of file types, no list of data fields and no confirmation of customer records versus corporate documents have been published. In the absence of a verified disclosure, the precise categories of information cannot be stated as fact.

What's at stake

Telecommunications records can contain identifiers, contact details and service histories that remain useful for targeted fraud or account takeover even years after collection. When such material appears in ransomware claims, the primary risks are misuse for impersonation and the possibility that copies continue to circulate after the initial listing. For the organisation, the episode adds to the costs of incident response, regulatory notification and any subsequent legal or contractual obligations.

• Monitor accounts for unusual login attempts or service changes.
• Review bank and payment-card statements for unauthorised activity.
• Consider placing fraud alerts with credit-reference agencies where available.
• Change passwords for any Telkom-linked services and enable multi-factor authentication.

What to do if you're exposed

Individuals who believe their information may be involved should begin with basic account hygiene: enable multi-factor authentication on email and financial services, monitor statements, and report suspected misuse promptly to the relevant provider. A free exposure scan of an email address against known breach data sets can indicate whether the address has already appeared in previously published lists, providing a starting point for further checks.

AICompiled with AI assistance from public sources and published under our editorial standards.