dukcapil.kemendagri.go.id (SIAK DUKCAPIL MINISTRY OF HOME AFFAIRS OF INDONESIA) Listed by babuk2 Ransomware Group

On March 18, 2025, the Babuk2 ransomware group listed dukcapil.kemendagri.go.id, the public-facing domain of Indonesia’s SIAK DUKCAPIL civil registration system operated by the Ministry of Home Affairs, claiming to have exfiltrated internal files during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the incident involves the compromise of systems tied to Indonesia’s national population and civil registration database. The attackers posted details on their leak site, accessible via the onion address hosted on the ransomware.live tracker. Available reporting describes the exposed material as internal files, though the precise volume and full list of records remain unconfirmed by the Indonesian government at the time of writing. No official victim count has been released, leaving millions of citizens whose personal records are housed in the SIAK system potentially exposed.

March 18, 2025 marks the public disclosure date on the Babuk2 leak site. The data types referenced include government-held personal information commonly stored in civil registries, such as names, identification numbers, addresses, and family relationship details.

Why This Matters for You and Your Family

If you or any member of your family holds Indonesian citizenship or has ever registered a birth, marriage, divorce, or residency through the national system, your information may now sit in a ransomware operator’s hands. These records are not abstract bureaucratic documents. They contain the exact details needed to open bank accounts, apply for government services, or impersonate you in official settings. For families, a single leak can affect every household member whose details are linked through the same registration records.

Once such data leaves official servers, it rarely stays contained. It moves quickly into underground markets where buyers combine it with other stolen credentials to build complete identity profiles. You cannot assume the breach will be quietly contained or that the government will notify every affected person in time.

The Doxxing and Identity-Chain Implications

Civil registry data is especially dangerous because it creates direct links between government ID numbers, full legal names, current and previous addresses, parents’ names, and children’s records. Attackers use these connections to map entire families. A phone number tied to one person’s ID can be matched to social media handles, email addresses, and gaming accounts. This is exactly how isolated credential leaks cascade into full doxxing campaigns that expose your home address, family relationships, and daily routines.

Credential leaks like this one frequently lead to account takeovers on platforms that reuse the same email or password. Children’s gaming accounts are particularly vulnerable because parents often link them to family emails or phone numbers listed in official records. Once an attacker controls a child’s gaming profile, they can harvest additional personal details shared in chats or linked payment methods, lengthening the identity chain that leads back to the rest of the household.

Babuk2’s Publicly Known Track Record

Public reporting attributes the Babuk2 ransomware group with activity that emerged in late 2024 as a rebrand or successor to earlier Babuk operations. The group has targeted government agencies and large organizations in multiple countries, typically gaining initial access through phishing or unpatched remote desktop services. After exfiltrating data, Babuk2 follows a double-extortion playbook: they demand payment to prevent publication and threaten to release the files on their leak site if the deadline passes. Notable prior victims include other public-sector entities where citizen records may have been exposed, following the same pattern of listing samples and then auctioning or dumping the full archive.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from the 13.1 billion+ breach records now circulating across more than 100 platforms.
• Rotate any password you used on Indonesian government sites or services that share the same email address, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and addressed within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same leaked addresses and phone numbers.
• Let remediation specialists handle takedown requests across data brokers and underground forums where your information may already be appearing.

The incident demonstrates that even national government databases can be breached and publicly listed within days. Protecting your family now requires more than hoping official notifications arrive in time. Start your DoxxScan trial today for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that connects scattered online handles to your real identity, and hands-on remediation by specialists who manage the cleanup work for you and your household, including children’s gaming accounts vulnerable to cascading takeovers.