On 20 June 2024 the Brain Cipher group, using a LockBit 3.0 variant, encrypted systems at Indonesia's temporary national data centre (PDNS). Around 210 public services — including immigration — were disrupted, as 24 ministries and 32 agencies stored data there. The most damaging finding: only about 2% of the data had been backed up, so a containable incident became a national outage.
It was not the first warning. In May 2023 LockBit hit Bank Syariah Indonesia, disrupting services for days and claiming 1.5 TB of customer data. In 2021 data on about 279 million BPJS Kesehatan members appeared for sale online. Indonesian hospitals were among the first local WannaCry victims in 2017 — one recovered because its backups worked.
Indonesia's cyber agency logged 5.5 billion attack events in 2025. Across the known cases the same doors keep opening: remote access and accounts without MFA, and backups nobody tested.
What it means for your business
- Follow the 3-2-1 backup rule and test restores regularly.
- Enforce MFA on remote access and privileged accounts.
- Know which services must come back first, and rehearse it.
How MTH can help: Our Security Operations and Managed Services include backup and disaster-recovery design, restore testing and ransomware playbooks aligned with UU PDP.
This briefing is original commentary by MTH based on public reporting; figures are as reported by the sources named above and may be revised over time.
