PT Indo Tambangraya Megah Data Breach

PT Indo Tambangraya Megah (ITMG), a prominent publicly listed coal mining company in Indonesia, was listed by the ransomware group RansomHouse on October 2, 2026. SOCRadar’s Cyber Threat Intelligence (CTI) identified significant stealer-log data exposure affecting the company’s webmail and corporate email accounts, as well as its recruitment portal, spanning from May 2024 to July 2026. This prolonged exposure of credentials, including those from job applicant submissions, raises serious concerns regarding potential data exfiltration and misuse. As an IDX-listed entity, ITMG faces considerable risks related to operational continuity, investor confidence, and regulatory compliance. The initial appearance of stolen credentials linked to PT Indo Tambangraya Megah in underground markets dates back to May 2024. Over the subsequent 26 months, a consistent stream of webmail and corporate email accounts from this major Indonesian coal producer continued to surface in stealer logs. This sustained period of credential exposure prior to the RansomHouse listing suggests a protracted compromise or a persistent vulnerability. RansomHouse’s modus operandi involves leveraging exfiltrated data for extortion, which for a publicly traded company like ITMG, carries implications beyond data theft, including potential impacts on stock value and adherence to stringent disclosure regulations.

SOCRadar’s analysis of stealer-log data revealed credential exposure related to PT Indo Tambangraya Megah between May 2024 and July 2026. The dataset encompasses three distinct categories of compromised credentials: webmail accounts accessible via webmail.itmg[.]co[.]id, corporate domain accounts associated with itmg[.]co[.]id, and a significant 19 records originating from the company’s recruitment portal. The presence of recruitment portal data is particularly concerning, as it involves personal information submitted by job applicants with no expectation of it being exposed on the dark web. The implications of this credential exposure are significant. Access to corporate webmail can facilitate business email compromise (BEC) attacks, executive impersonation, and further internal network reconnaissance. The exposure of corporate domain credentials could grant attackers broad access to internal systems and sensitive data. For PT Indo Tambangraya Megah, which operates in the mining sector and is listed on the Indonesia Stock Exchange (IDX), these risks are compounded by potential impacts on investor relations and regulatory obligations overseen by Otoritas Jasa Keuangan (OJK). Given the prolonged nature of the credential exposure and the listing by RansomHouse, ITMG should undertake immediate and comprehensive security measures. This includes a thorough audit of access logs across the entire 2024-2026 timeframe, rotation of all credentials on affected domains, and a detailed assessment of whether the incident necessitates disclosure under IDX and OJK regulations. Engagement with the Badan Siber dan Sandi Negara (BSSN) for cybersecurity incident response and technical assistance is also highly recommended. Continuous monitoring of dark web marketplaces and stealer logs for any further activity related to ITMG should be maintained.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.