Badan Pengelola Keuangan Haji Listed by blackshrantac Ransomware Group

On November 29, 2025, Indonesian government agency Badan Pengelola Keuangan Haji (BPKH) appeared on the leak site of the blackshrantac ransomware group. The agency, which manages finances for Indonesians making the Hajj pilgrimage, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose data may have been exposed remains unknown, anyone who has registered for Hajj, made payments to BPKH, or had their financial records handled by the agency could be affected.

What's Publicly Reported from Reporting

Public reporting indicates that BPKH, an agency based in Jakarta and established under Indonesian Law No. 34 of 2014, was listed on the blackshrantac leak site. The data taken consists of internal files exfiltrated in a ransomware incident. No confirmed total of records or specific victim count has been published. The listing appeared on November 29, 2025, on an onion address hosted via ransomware.live. Available reporting describes the exposed material as documents related to the agency’s financial operations for pilgrimage funding, risk management, and participant accounts.

Why This Matters for You and Your Family

If you or anyone in your family has ever applied for Hajj, transferred money for pilgrimage costs, or had personal details stored with BPKH, your information may now be in attackers’ hands. Internal files from government agencies often contain names, addresses, phone numbers, identity card details, banking information, and family records. Once this data leaves official systems, it can be sold, traded, or used to target you directly. For ordinary families saving for years to afford the Hajj, the breach adds financial worry and the risk of identity theft on top of an already stressful process.

The Doxxing and Identity-Chain Implications

Stolen government records rarely stay isolated. Attackers combine leaked names, phone numbers, and addresses with information from other breaches to build detailed profiles. A single Hajj registration record can link your real identity to travel documents, family members’ names, and payment histories. These links make it easier for criminals to impersonate you, open accounts in your name, or harass your family. Credential leaks like this one often cascade into gaming account takeovers when the same email or password was reused for a child’s Fortnite, Roblox, or mobile game account. The chain from pilgrimage data to personal doxxing can happen quickly.

Blackshrantac’s Known Track Record

Public reporting attributes the blackshrantac ransomware group with operations that include stealing data and then publishing it on leak sites when victims do not pay. The group emerged in recent years and has listed both private companies and government-linked organizations. Their typical playbook involves gaining initial access to networks, exfiltrating sensitive files, encrypting systems, and then demanding payment to prevent public release of the stolen data. Available reporting describes their extortion style as posting samples or full datasets on dark web leak pages with countdown timers.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, family names, and real identity across breach records.
• Rotate any password you have used for government portals, Hajj-related websites, or banking services and enable 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests for any exposed personal records found on data broker sites or forums.

The BPKH breach is a reminder that even organizations handling deeply personal matters like religious pilgrimages can become targets, leaving ordinary families exposed. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand exactly what is exposed and begin closing those doors.