Dinas Komunikasi dan Informatika Data Breach

Dinas Komunikasi dan Informatika, the Communication and Informatics Service of Central Java Province in Indonesia, has been listed as a victim by the Panzer ransomware group on their dark web portal on September 3, 2026. This listing was identified by SOCRadar’s Dark Web Monitoring service. As the agency responsible for managing digital communications and IT infrastructure for a highly populated province, its appearance on a ransomware leak site is a significant development for Indonesian public sector cybersecurity. Panzer ransomware has demonstrated a consistent pattern of targeting government and defense entities. In the 60 days preceding this listing, the group claimed 17 other victims, with Indonesia, Serbia, and Italy being the most frequently targeted countries. While government bodies are the primary focus, Panzer has also affected technology and manufacturing organizations. Previous notable victims include the Directorate-General for Education (Portugal), Government of Vojvodina (Serbia), Castilla La Mancha (Spain), and Surakarta University (Indonesia). Dinas Komunikasi dan Informatika aligns directly with Panzer’s established targeting profile of government ICT services in the Asia-Pacific and European regions.

SOCRadar’s analysis of stealer-log telemetry returned no records associated with the domain diskominfo[.]jatengprov[.]go[.]id within the queried data. It is important to note that Indonesian government domains ending in .go.id might appear in stealer logs under different subdomain variations or through user-specific entries that are not captured by a top-level domain query. Therefore, the absence of a direct result in this specific query does not definitively rule out the possibility of credential exposure within other segments of the organization’s digital infrastructure. The potential for infostealer-harvested credentials to facilitate ransomware operations remains a concern. While no direct correlation was found in the analyzed stealer logs for diskominfo[.]jatengprov[.]go[.]id, the broader threat actor landscape often leverages compromised credentials obtained through various means, including phishing, malware, or exploitation of vulnerabilities, to gain initial access to corporate networks. These credentials can then be used to move laterally, escalate privileges, and deploy ransomware. Organizations in similar sectors and regions should consider continued dark web monitoring, proactive credential hygiene checks, and a review of multi-factor authentication status for all critical systems and user accounts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.