CRACKED SCREEN: Exposing Indonesia’s Cyber Vulnerabilities Amid Digital Transformation

Cybersecurity Analysis | April 2026

Indonesia is racing toward a digital future. Its digital economy is the largest in Southeast Asia, with more than 229 million internet users — surpassing the global penetration average. But behind this rapid surge lies a troubling paradox: the faster Indonesia transforms digitally, the wider the security gaps that crack open.

The numbers speak loudly. Not about potential future threats — but about attacks that have already happened, data that has already been stolen, and systems that have already collapsed. Indonesia is the most cyberattacked nation in all of Southeast Asia, yet paradoxically also the one that allocates the least to protect itself.

1. Ground Zero: Indonesia at the Top of Regional Targets

The figures are not merely statistics — they are alarms that keep ringing.

Bank Indonesia reported more than 370 million attempted cyber threats targeting the country throughout 2024, with a 25% surge in anomalous cyber traffic compared to the previous year. Digital Watch Observatory That translates to more than one million attempted attacks every single day.

Indonesia faces the highest number of cyberattacks in Southeast Asia, averaging 3,300 attacks per week — far exceeding Malaysia and Singapore, which each experience less than half that number. Bankinfosecurity

The types of attacks are diverse and increasingly sophisticated. Check Point data places Indonesia as Southeast Asia’s epicenter for cryptomining, botnet, mobile malware, and info stealer attacks. Botnet attacks account for 18.8% of all attacks against Indonesian businesses, while info stealers account for 16.9%. Bankinfosecurity

BSSN recorded a 70% increase in phishing cases compared to the previous year, while ransomware attacks rose by 50%, causing financial losses and service disruptions across institutions. VIDA

Indonesia has become the most vulnerable target not merely due to technical weakness, but because of a lethal combination: blazing-fast digital growth, an enormous internet user base, and critically low security investment.

2. When a Nation’s Data Falls into Hacker Hands: The PDNS Incident of 2024

No event more starkly illustrates Indonesia’s cyber vulnerability than the attack on the Temporary National Data Center (PDNS) in June 2024.

On June 20, 2024, the PDNS server suffered a serious disruption from a ransomware attack. According to BSSN Chief Hinsa Siburian, the attack began on June 17, 2024 with attempts to disable the Windows Defender security feature. At 00:54 WIB on June 20, the ransomware began installing malicious files, deleting critical files, and disabling operational services. DTrust

The culprit? The attackers used ransomware called “Brain Cipher Ransomware,” the latest development of LockBit 3.0, demanding a ransom of USD 8 million — approximately IDR 131.6 billion. Binus University

The impact was massive and immediately felt by the public. Around 282 government agencies were affected, and only 44 had data backups. Immigration services including the autogate, visa, residence permits, M-Passport, and online travel bans were disrupted. Some 800,000 records of Smart Indonesia Card (KIP) applicants were exposed, and 47 services under the Ministry of Education and Culture were knocked offline. DTrust

More alarming still: BSSN stated that the breach occurred due to poor governance — the Ministry of Communication and Information Technology had not created any backup or redundancy for the data stored inside the PDN servers. LK2 FHUI Worse, BSSN had already sent warnings to the Ministry before the PDN was hacked, but received no response. Wantimpres

The PDNS case is not an anomaly. It is a mirror of a broader pattern: systems built in haste to keep up with digitalization, without an adequate security foundation underneath.

3. The Data Breach Crisis: A Cycle That Keeps Repeating

The PDNS incident is merely the tip of the iceberg. SOCRadar data shows that the public administration sector dominates dark web exposure at 34.93%, reflecting sustained and high interest from threat actors in Indonesian government data. SOCRadar

Throughout 2023 and the first half of 2024, Indonesia faced 130 unique ransomware incidents, with 24 specifically targeting Indonesian organizations. Prominent ransomware groups such as LockBit 3.0, ALPHV Blackcat, and Play were recorded as the most active in the region. SOCRadar

In the financial sector, in September 2024, a major Indonesian cryptocurrency trading platform suffered a cyberattack resulting in losses of approximately USD 22 million, exposing deep vulnerabilities within the financial technology sector. Business-indonesia

In the phishing landscape, the information services industry emerged as the primary target with 4,046 recorded attacks. Stealer Log data also led to significant breaches, compromising critical information such as passwords, credit card details, and victim IP addresses. SOCRadar

Data breaches are not merely the loss of information — they carry a cascade of consequences. Stolen data is traded on dark web marketplaces, weaponized for identity theft, financial fraud, and larger-scale espionage operations.

4. The Root Problem: The Lowest Security Investment in Southeast Asia

Here lies the most painful paradox. Indonesia is the largest economy in Southeast Asia, yet also the most negligent when it comes to protecting its own cyberspace.

According to Kearney’s analysis, Indonesia’s cybersecurity spending as a percentage of GDP stands at just 0.02% — the lowest in all of Southeast Asia. Bankinfosecurity For comparison, Singapore allocates more than ten times that proportion.

The average cybersecurity spend per employee in Indonesia is only around USD 18.89 — far below that of more developed markets. Business-indonesia

This chronic underinvestment creates a dangerous gap between the pace of digitalization and the readiness to defend it. CYFIRMA identifies several key factors that make Indonesia a prime target: accelerated digitalization across public and private sectors that expands the attack surface, often outpacing security capabilities; widespread use of unsecured systems and low user awareness that provide easy entry points for phishing, malware, and credential theft; and inconsistent regulatory enforcement and outdated infrastructure that create exploitable vulnerabilities. CYFIRMA

5. The Human Capital Crisis: 100,000 Experts That Don’t Exist Yet

Even if budgets were available, Indonesia faces another equally serious obstacle: a severe shortage of cybersecurity professionals.

Indonesia needs 100,000 cybersecurity specialists, yet produces only a fraction of that number — even though the Digital Talent Scholarship program trained 500,000 individuals between 2018 and 2024. Mordor Intelligence This suggests that existing training has not successfully converted into job-ready cyber professionals.

Salary premiums divert senior staff toward fintech and telecommunications companies, leaving critical infrastructure teams severely understaffed. Entry-level packages averaging IDR 120–180 million per year deter SMEs from hiring in-house analysts. Mordor Intelligence

Demand for cybersecurity talent is projected to surge by 28% annually, yet entry-level positions often remain unfilled for months because companies cannot find people with the right skills. Nucamp

The result is that critical infrastructure — from banking systems and energy grids to public government services — operates without adequate protection. Not necessarily out of unwillingness, but because there simply are not enough qualified people to do the job.

6. Regulation: Present, But Not Enough

Indonesia has not stood idle. A number of regulations have been enacted, but their implementation still falls far short.

The government has issued Law №27 of 2022 on Personal Data Protection (UU PDP) and Presidential Regulation №47 of 2023 on the National Cybersecurity Strategy and Cyber Crisis Management. LK2 FHUI But regulation on paper does not automatically translate into real-world protection.

Organizations must navigate overlapping mandates — BSSN’s incident norms, the Ministry’s PDP enforcement, OJK’s fintech rules, and Bank Indonesia’s SysSec Regulation 2/2024 — creating audit fatigue and duplicated reporting. During the National Data Center outage, overlapping command structures slowed root-cause analysis and delayed the response. Mordor Intelligence

BSSN itself has highlighted that one of Indonesia’s core vulnerabilities is the absence of a comprehensive, specific Cybersecurity Law. LK2 FHUI A Cybersecurity Bill remains under deliberation, while attacks continue arriving without waiting for the legislative process to conclude.

7. The Threat Actors: Far More Than Opportunistic Hackers

The threats facing Indonesia go well beyond opportunistic criminal hackers. CYFIRMA has identified the presence of state-sponsored Advanced Persistent Threats (APTs) — including Lazarus Group, Gothic Panda, and Fancy Bear, linked to North Korea, China, and Russia respectively — alongside financially motivated groups such as TA505, FIN7, and FIN11. The presence of these actors signals a mix of espionage, financial crime, and strategic cyber operations. CYFIRMA

Indonesia’s strategic position in the Indo-Pacific makes it a focal point for cyber espionage amid rising regional tensions, particularly those involving China, the United States, and Australia. CYFIRMA

This places Indonesia not merely as a victim of ordinary cybercrime — but as a geopolitical target. Citizens’ data, energy infrastructure, military communications systems — all of these are valuable commodities in the eyes of state-level actors operating in the shadows.

8. The Path Forward: From Reactive to Proactive

The good news is that Indonesia is aware of the problem and has begun moving. Indonesia’s cybersecurity market is projected to grow from USD 1.62 billion in 2026 to USD 4.06 billion by 2031, at an annual growth rate of 20.12%. Mordor Intelligence

Microsoft has committed to investing USD 1.7 billion in AI and cloud capacity in Indonesia, with plans to train 840,000 Indonesians in AI skills over four years. Business-indonesia

But private investment alone is not sufficient. Several urgent steps need to be prioritized:

First, build a security culture from the ground up. Most successful attacks succeed not because of technological failure — but because of human error. Clicking phishing links, using weak passwords, and failing to activate two-factor authentication remain the primary entry points for attackers. Public awareness campaigns need to reach not just tech professionals, but every citizen with a smartphone.

Second, enforce regulation with real consequences. The Personal Data Protection Law exists, but its enforcement must be strengthened. Companies and government agencies need to be audited regularly, not merely obligated on paper. Organizations that fail to protect their data must face meaningful penalties.

Third, invest seriously in human capital development. The gap between needing 100,000 cybersecurity experts and the current rate of production cannot be closed through short-term training programs alone. A structured cybersecurity education ecosystem is needed — from university curricula to professional certification pathways — with government-backed incentives to attract and retain talent in the public sector.

Fourth, build genuine cross-sector coordination. The PDNS case demonstrated how dangerous information silos between agencies can be. A national cybersecurity coordination center with real authority and rapid response capability is not a luxury — it is a necessity.

Conclusion: Digital Transformation Must Be Matched by Security Transformation

Indonesia is building its digital future with ambition. A digital economy worth hundreds of billions of dollars, millions of SMEs going online, government services becoming fully digital — these are advances worth celebrating.

But building a skyscraper without a solid foundation only invites disaster. As Southeast Asia’s largest economy and a rapidly growing digital hub, Indonesia has become an increasingly attractive target for sophisticated cyber threats. IndoSec And as long as security investment fails to keep pace with the rate of digitalization, that gap will continue to be exploited.

Cybersecurity is not a cost — it is an investment. Not a barrier to innovation — but the foundation that allows innovation to stand firm. And it is not the responsibility of government or corporations alone — it is the collective obligation of every digital citizen in Indonesia.

Because in this connected world, one person’s security is everyone’s security.

— End —

Data sources: Bank Indonesia, BSSN, SOCRadar Indonesia Threat Landscape Report 2024–2025, CYFIRMA, Check Point Research, Mordor Intelligence, Kearney.