Massive data breach at Indonesia’s tax agency DJP exposes information of 6 million taxpayers

Indonesia’s tax agency, DJP, has suffered a major data breach, leaking personal and government-issued information of six million taxpayers, including President Joko “Jokowi” Widodo, his family, and other high-profile government officials.

The breach surfaced on the cybercrime marketplace BreachForums and was publicized by the threat actor ‘Bjorka’ and offered for sale for $10,000, equivalent to 150 million Rupiah. The leaked information includes taxpayer identification numbers (NPWP), national identification numbers (NIK), email addresses, phone numbers, and other personally identifiable data.

While the tax agency has not confirmed the exact scope of the breach, prominent figures such as Widodo’s sons, Kaesang Pangarep and Vice President-elect Gibran Rakabuming Raka, were reportedly affected, along with Finance Minister Sri Mulyani Indrawati and several other senior ministers. Dwi Astuti, Director of Public Relations at the tax agency, confirmed an investigation is underway to determine the extent of the breach. However, it remains unclear whether individual tax returns, a potentially politically significant piece of information, were part of the leak. It is also unknown why only 6 million of Indonesia’s 45.43 million registered taxpayers were affected.

Potentially impacted taxpayers are advised to remain vigilant for phishing scams, as cybercriminals armed with personal information may attempt extortion, claiming tax arrears and demanding payments. Despite the gravity of the breach, there has been no indication that Indonesia’s tax systems were disrupted, and the tax agency has ruled out a ransomware attack.

The breach has raised significant concerns about Indonesia’s cybersecurity infrastructure. Indonesia, the fourth most populous country globally, has suffered numerous breaches across government institutions, with over 280 agencies compromised. Despite this, the country ranks third-lowest among G-20 nations in cybersecurity measures, making it a target for cybercriminals. Earlier this year, a ransomware attack on Indonesia’s National Data Center disrupted services across 300 agencies, adding to the nation’s growing list of cyber incidents.