Jakarta to review lax data center monitoring after cyberattack

The cyberattack on dozens of Indonesian government entities exposed extraordinarily lax oversight, with Friday revealing that much of the information stored in state data centers was not backed up.

Indonesian President Joko Widodo has ordered an audit of government data centers after officials admitted that much of the data was affected by the recent ransomware attack and exposed the country's vulnerability to such attacks.

The cyberattack, which first struck last week, was the worst in Indonesia in recent years and disrupted several government services, including immigration and operations at major airports.

SEE ALSO: US plans 'aggressive' data security rules for Chinese electric vehicles

The government said more than 230 public agencies, including ministries, had been affected, but refused to pay the $8 million ransom demanded to recover the encrypted data.

In response to the cyberattack, Indonesia's state comptroller said the president had asked him to review the country's data centers.

The audit will focus on “governance and financial aspect”, said Muhammad Yusuf Ateh, who heads Indonesia's Development and Financial Controller (BPKP), after attending a cabinet meeting led by Widodo on Friday .

Hinsa Siburian, an official who chairs Indonesia's cybersecurity agency known by its acronym BSSN, said 98% of government data stored in one of the two compromised data centers had not been backed up.

“In general, we consider that the main problem is governance and that there is no alternative solution,” he told a parliamentary hearing on Thursday evening.

Some lawmakers have rejected this explanation.

“It’s not the lack of governance that’s stupid”

“If there is no reinforcement, it is not a lack of governance,” said Meutya Hafid, president of the commission overseeing the incident. “It’s stupidity.”

A BSSN spokesperson did not immediately respond when asked whether it would be possible to recover the encrypted data.

Indonesian Communications Minister Budi Arie Setiadi said the ministry had backup capacity in data centers, but it was optional for government agencies to use the service.

He said government agencies were not backing up data due to budget constraints, adding that it would soon become mandatory.

The cyberattack sparked criticism of the minister on social media in Indonesia.

Digital advocacy group SAFEnet launched a petition calling for Budi's resignation, citing his lack of accountability for repeated cyberattacks.

Budi sent Reuters a separate petition asking him to stay on as minister when asked to comment on calls for his resignation.

The minister told parliament that a “non-state actor” seeking money was behind the attack and that government services should be fully restored by August.

Ransomware attackers use software to encrypt data and demand payment from victims to restore the data. Indonesia said the attacker in this particular incident used existing malware called Lockbit 3.0.

“Taiwanese” cyber crooks to be deported

Meanwhile, in related news, Indonesian immigration authorities announced on Friday that they had arrested 103 Taiwanese passport holders suspected of carrying out a cybercrime operation on the island of Bali.

Wednesday's operation was the largest arrest this year, the immigration agency said.

Bali Immigration Director Saffar Muhammad Godam told reporters that authorities would soon deport the Taiwanese passport holders after arresting them in a sting operation at a villa in Bali's Tabanan district.

“The 103 foreign nationals remained in the villa and carried out suspicious activities, which we suspect to be cybercrime-related activities,” he said while displaying laptops and routers at the press conference.

Those arrested were also suspected of misusing their visas, he added.

However, Taiwan's foreign ministry said its de facto embassy in the country had been informed that of the 103 foreign nationals arrested, at least 14 were suspected of being Taiwanese.

Taiwan will send consular staff to Bali and has asked Indonesia to return the suspects to Taiwan as soon as the investigation is completed, the ministry said in a statement.

Reuters was not immediately able to contact the legal representatives of the arrested Taiwanese.

Godam said the scam targeted people coming from abroad and not Indonesians.

• Reuters with additional editing by Jim Pollard

ALSO WATCH:

Indonesian airports and data centers hit by worst cyberattack in years

Fraudulent compounds in Southeast Asia to steal $64 billion by 2023: report

Wave of high-tech crime in Asia: cyberscams and casinos loot billions

Big Tech does little to counter widespread social media scams

Cybercrime gang Lockbit claims it is operational again

Russians named as Westerners who dismantled Lockbit ransomware gang

China plans to train 45,000 companies on hacker protection measures

AI chiefs say deepfakes are a threat to the world, call for regulation

Fake Chinese accounts are flourishing on X, according to a Washington Post analysis