Sensitive Information of 5,000 Users Leaked from Indonesian Government Website

In August 2024, a significant cybersecurity incident compromised the Blora District Government’s website, exposing sensitive information of approximately 5,000 users. This breach is a stark reminder of the vulnerabilities even within government institutions and shows the critical need for more serious cybersecurity and operational security measures.

Overview of the Blora District Government

The Blora District, located in Central Java, Indonesia, is known for its rich history, extensive teak forests, and agricultural resources. The district's government plays a pivotal role in managing civil registrations, local taxes, public services, and economic development, serving a population of over 870,000 residents.

Key Services Provided:

• Civil Registrations: Management of birth, marriage, and death records.
• Public Service Portals: Handling local taxes, business registrations, and public health data.
• Economic Development: Overseeing land use, agricultural policies, and natural resource management.

Blora’s digital platforms are integral to the district's governance, making this breach particularly concerning.

Details of the Breach

When: The breach was identified in August 2024 by a dark web user known as "Sardoche," who disclosed the incident on a notorious cybercrime forum. The hacker provided a sample of the compromised data, indicating a severe breach.

What Was Exposed:

• Personal Identifiable Information (PII): Names, addresses, national ID numbers, and contact information.
• Civil Records: Details from birth, marriage, and death certificates.
• Tax Information: Local tax records, including property tax details and business registrations.
• Health Data: Information related to public health services, potentially including vaccination records.

Nature of the Attack: The exact method used by the attacker is yet to be fully disclosed. However, initial reports suggest a vulnerability in the website's authentication system, which was exploited to gain unauthorized access to the server.

Threat Actor Profile:

• Alias: Sardoche
• Forum Activity: Newly joined in August 2024, suggesting this could be an emerging threat actor or a pseudonym for a more established hacker.
• Motives: Likely financial gain or to destabilize public trust in local governance, a common motive among cybercriminals targeting government institutions.

Impact on the Community

This breach has profound implications for the citizens of Blora:

• Identity Theft: With PII exposed, residents are at heightened risk of identity theft, where their information could be used to open fraudulent accounts or commit other crimes.
• Phishing Attacks: The stolen data can be weaponized in sophisticated phishing attacks, tricking individuals into disclosing further sensitive information.
• Public Trust: This incident is likely to erode the public’s trust in the local government’s ability to protect their information, particularly given the critical nature of the data involved.
• Operational Disruptions: The breach could hinder the district’s ability to deliver essential services if internal systems are compromised.