Data leaks and hacks still happen repeatedly in Indonesia

In Indonesia, it seems to have become a commonplace when data leaks occur. Leaked BKN (State Civil Service Agency) ASN data is usually sold on the Breachforums hacker forum for around $10,000 or the equivalent of Rp160,000,000.

In one such case, a hacker community by the name of Lockbit hacked 1.5 Terrabytes of data containing 15 million BSI personal data. The data included personal user data, passwords, employee data, and other important documents.

In addition, there were also allegations of data leaks at the Directorate General of Population and Civil Registration (Dukcapil) of the Ministry of Home Affairs as much as 337 million data in July 2023. At that time, Dukcapil denied this and said the data that was successfully hacked was different from that in the database.

From there a name emerged that shocked the Indonesian cyberspace, Bjorka. This hacker said that as many as 105 million voters' data from the KPU's official website had been leaked in September 2022. The leaked data includes the full name, NIK (population identification number), and even the voter's address.

Not only that, there were also 19.56 million BPJS Employment data traded on a hacker gathering site, Darkweb, in March 2023 orchestrated by Bjorka.

Although not included as a data leak case, the paralysis of the Temporary National Data Center (PDNS) 2 caused by ransomware attacks is also of concern to everyone because it is related to cyber security in Indonesia.

Then the latest alleged BKN ASN data leak case that occurred was stated by the CISSReC Cyber Security Research Institute to have originated from a post from a hacker with the nickname "TopiAx" on Breachforums on August 10, 2024. TopiAx said that he managed to steal data from BKN totaling 4,759,218 data.

Among them are name, place of birth, date of birth, title, date of CPNS, date of civil service, NIP, civil service number, civil service number, class, position, agency, address, identity number, mobile phone number, email, education, major, year of graduation. In addition, there are still many other data both cleartext and text that have been processed using cryptographic methods.

With the increasingly frequent incidents of personal data leakage, according to CISSReC, what the government needs to do immediately is to establish a Personal Data Protection Agency so that action can be taken and sanctions can be imposed on PSEs that experience these data leakage incidents.

/Yunan