Indonesia Threat Landscape Report 2026

Key Insights from Indonesia’s Cyber Threat Landscape

• Data Theft Dominates Dark Web Activity: Data breach and compromise accounts for 86.78% of Dark Web threat categories, making large-scale data exposure the primary threat model.
• Public Administration Faces the Highest Exposure: Public Administration accounts for 49.21% of Dark Web threats, reflecting sustained attacker interest in government data, citizen records, internal communications, and administrative credentials.
• Education Is Also Highly Targeted: Educational Services ranks second at 18.58%, driven by institutions that store large volumes of personal data but may operate with limited security budgets.
• The Top Three Sectors Carry Most Dark Web Risk: Public Administration, Educational Services, and Finance and Insurance together account for over 76% of Dark Web threats targeting Indonesia.
• Credential Abuse Enables Larger Breaches: Unauthorized Access and Credentials accounts for 7.28% of Dark Web threat types, confirming credential theft as the second most common threat type.
• Ransomware Activity Is Fragmented: The top three ransomware groups account for only 34% of incidents, while 66% falls under “Others.”
• The Gentlemen Leads Ransomware Activity: The Gentlemen accounts for 13.2% of ransomware incidents, followed by Nova at 11.3% and Coinbase Cartel at 9.4%.
• Government Entities Face Direct Breach and Extortion Risk: Public Administration leads both Dark Web threats at 49.21% and ransomware targeting at 16.92%.
• Finance Leads Phishing Targeting: Finance accounts for 26.99% of phishing activity, and together with Banking at 5.31%, the financial sector faces over 32% of phishing attacks.
• Digital Wallets and Gaming Platforms Are Common Lures: DANA, Roblox, and Mobile Legends appear among the most impersonated phishing page titles.
• HTTPS Is No Longer a Reliable Trust Signal: 67.1% of phishing sites targeting Indonesia use HTTPS, making the browser padlock unreliable as a safety indicator.

Why This Report Matters

Indonesia’s threat landscape shows a clear split between Dark Web, ransomware, and phishing activity. Dark Web threats focus overwhelmingly on government and education-related data, while ransomware targets sectors where operational downtime creates pressure. Phishing campaigns follow a different pattern, focusing on finance, digital assets, telecommunications, gaming platforms, and digital wallet users.

For public administration, education, finance, telecom, and critical-sector organizations, early visibility into leaked databases, exposed credentials, access listings, ransomware activity, and phishing infrastructure is critical. The presence of digital wallet and gaming-related lures also shows that attackers are exploiting Indonesia’s digital demographics, targeting both consumers and users who may reuse credentials across personal and institutional accounts.

Take Action Now

• Dark Web Monitoring: Detect leaked databases, exposed credentials, citizen records, and access listings tied to Indonesian organizations.
• Ransomware Intelligence: Track The Gentlemen, Nova, Coinbase Cartel, and smaller ransomware groups targeting Indonesia.
• Phishing Detection & Response: Identify finance, cryptocurrency, digital wallet, gaming, redirect-based, and HTTPS-enabled phishing campaigns.
• Access Security: Strengthen MFA, monitor privileged accounts, rotate exposed credentials, and reduce credential-based attack paths.
• Public-Sector Risk Monitoring: Track exposure affecting public administration, civil service systems, education, and other data-rich government-linked entities.