Bank Syariah Indonesia (BSI) ransomware attack
The LockBit ransomware gang crippled Indonesia's largest Islamic bank for days, then leaked 1.5 TB of data covering some 15 million customers and employees after a $20 million ransom went unpaid.
- Victim
- Bank Syariah Indonesia
- records
- 1500.00B
- users
- 15.0M
On 8 May 2023, Bank Syariah Indonesia (BSI) — the country's largest Sharia-compliant bank, formed from the 2021 merger of three state-owned Islamic banks — suffered a multi-day outage of its ATMs, mobile banking, and branch services. The LockBit ransomware gang later claimed the attack and leaked 1.5 TB of stolen data after BSI declined to pay a US$20 million ransom.
What happened
Customers across Indonesia found ATMs, the BSI Mobile app, and in-branch transaction systems unavailable starting 8 May. The bank initially attributed the disruption to system maintenance, but the outage stretched across several days, fuelling speculation of a cyberattack.
On 13 May 2023, the LockBit ransomware operation posted BSI on its dark-web leak site, claiming to have exfiltrated 1.5 terabytes of data spanning nine databases. LockBit said the trove covered roughly 15 million customers and employees, including names, phone numbers, addresses, account and card numbers, transaction histories, and internal documents. The gang set a 72-hour deadline and demanded US$20 million.
Impact
- BSI's core banking services were degraded or offline for several days, affecting millions of customers during the period overlapping the Eid post-holiday season.
- LockBit claimed 1.5 TB of data on around 15 million customers and staff.
- When negotiations failed, LockBit published the full dataset on 15 May 2023, moving the incident from extortion to a confirmed mass data leak.
Response
BSI publicly confirmed a cyberattack on 16 May, while maintaining that customer funds were secure and that services had been restored. Indonesia's Financial Services Authority (OJK) and the National Cyber and Crypto Agency (BSSN) engaged on the incident. The bank did not pay the ransom.
Why it matters
The BSI breach was a watershed for financial-sector resilience in Indonesia: a systemically important bank suffered both prolonged service disruption and a full customer-data leak, undermining trust during a sensitive religious-banking period. It foreshadowed the 2024 National Data Centre attack by the same LockBit-derived ecosystem, reinforcing concerns about Indonesia's exposure to ransomware operators using the LockBit 3.0 toolkit and the limited recourse available to victims under the country's nascent data-protection framework.
Financial impact
Reported costs in USD
Timeline
BSI's ATM network, mobile app, and branch transaction systems go offline; the bank initially calls it routine maintenance.
LockBit claims responsibility, stating it stole 1.5 TB of data and demanding a $20 million ransom within 72 hours.
With the deadline expired and no payment made, LockBit publishes the stolen dataset on its leak site.
BSI confirms a cyberattack while asserting customer funds and data remained safe; services are largely restored.
Sources
- thecyberexpress.comhttps://thecyberexpress.com/lockbit-bank-syariah-indonesia-cyber-attack/
- coconuts.cohttps://coconuts.co/jakarta/news/explained-the-ransomware-attack-on-bsi-indonesias-largest-islamic-bank/
- izoologic.comhttps://izoologic.com/2023/05/16/lockbit-hits-indonesian-bank-bsi-with-a-ransomware-attack/
- thejakartapost.comhttps://www.thejakartapost.com/paper/2023/05/16/data-breaches-still-haunt-indonesia.html