tni.mil.id Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target government and military organisations worldwide, using data theft and public leak-site listings to pressure victims. In this environment, claims of breaches against defence institutions raise particular concern because of the sensitivity of the information such bodies hold and the potential for wider security implications.

On 25 February 2025, the ransomware group apt73 listed tni.mil.id on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and the full scope of the incident has not been independently confirmed. The listing describes a database of the National Indonesian Army containing fields such as names, service numbers, ranks, corps, grades, units, positions and dates of birth. Because the claim originates from the group itself, it should be treated as unverified until further evidence emerges.

What happened

According to the available record, tni.mil.id was listed by the apt73 ransomware group on 25 February 2025. The group claims that internal files were exfiltrated during a ransomware attack. The reported summary characterises the material as a “DATABASE OF NATIONAL INDONESIAN ARMY” and lists partial field names including NAMA, NRP, PANGKAT, KORPS, GRADE, SATUAN, JABATAN and TGL LAH. No confirmed figure for the number of affected individuals has been published, and details of the intrusion method, exact timing of the attack, or whether any ransom was demanded or paid remain undisclosed in the public record.

As with many ransomware listings, the appearance of a victim on a leak site constitutes a claim by the threat actor rather than an independently verified disclosure. No further technical indicators or official statements confirming the scale or success of the intrusion are included in the facts available for this report.

The group behind it: apt73

apt73 is known publicly as a ransomware operator that follows the common double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if demands are not met. Groups of this type typically gain initial access through phishing, exploitation of unpatched remote services or compromised credentials, then move laterally to identify high-value files before exfiltration and encryption. They often publicise partial samples or file listings to increase pressure on the victim.

In this case, apt73 has listed tni.mil.id and claims responsibility for the exfiltration of internal files. No additional statements attributed specifically to this victim beyond the leak-site listing and the brief database description appear in the available facts. Prior activity by similarly named or styled ransomware groups has included targeting of government, defence-adjacent and critical-infrastructure organisations, though each incident must be assessed on its own evidence.

Who is tni.mil.id?

tni.mil.id is the official web domain associated with the Tentara Nasional Indonesia (TNI), the Indonesian National Armed Forces. As a national military organisation, it oversees personnel administration, operational planning, logistics and related defence functions. Organisations of this type routinely maintain databases of serving and former personnel that include identity details, service numbers, ranks, unit assignments, positions and biographical data such as dates of birth.

A breach claim against such an entity is consequential because military personnel records can reveal organisational structure, individual career histories and personal identifiers. Even partial exposure can assist adversaries in mapping force composition or enabling targeted social-engineering or identity-related harm against service members and their families.

What was likely exposed

The facts state that internal files were exfiltrated and describe the material as a database of the National Indonesian Army. The partial field list provided—NAMA (name), NRP (service number), PANGKAT (rank), KORPS (corps), GRADE, SATUAN (unit), JABATAN (position) and TGL LAH (date of birth)—indicates personnel-related records. Exact contents, total volume of data and whether additional categories of files were taken remain unconfirmed.

Military organisations typically hold far more than basic personnel tables: medical records, security clearances, contact information, family details, training histories and operational documents. Because the public record for this incident does not enumerate those categories, it is not possible to state that any specific additional data type was exposed. Readers should treat the named fields as the only concrete indicators currently available and regard the full scope as undisclosed.

Why it matters

For individuals whose records may appear in such a database, the primary risks are identity misuse, targeted phishing or social engineering that leverages accurate personal and professional details, and potential harassment or doxxing. Service numbers, ranks and unit assignments can make it easier for malicious actors to craft convincing messages that appear to come from legitimate military or government sources.

For the organisation itself, exposure of personnel data can degrade operational security by revealing force structure and individual postings. Even if the listing is later shown to be incomplete or exaggerated, the mere claim can erode trust among personnel and require resource-intensive verification and protective measures. In the broader threat landscape, successful or claimed attacks on defence institutions also serve as signals to other threat actors that similar targets may be vulnerable.

If your data was in this claimed breach

If you have any connection to the Indonesian National Armed Forces or believe your details may have been held by tni.mil.id, treat the possibility of exposure seriously even while the claim remains unverified. Monitor financial and government accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to unsolicited messages that reference your rank, unit or service number. Consider placing fraud alerts with credit bureaus if you reside in a jurisdiction that offers them, and avoid clicking links or opening attachments in unexpected emails that claim to relate to military or government matters.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. Doing so provides an additional, independent signal that can help you decide what further protective steps to take.

AICompiled with AI assistance from public sources and published under our editorial standards.