INDONESIA TAXPAYER IDENTIFICATION NUMBER (NPWP) Listed by babuk2 Ransomware Group

On January 28, 2025, the babuk2 ransomware group listed internal files stolen from an Indonesian government system containing taxpayer identification numbers known as NPWP.

What's Publicly Reported from Reporting

Public reporting indicates the babuk2 group published a post on its leak site claiming to have exfiltrated internal files during a ransomware attack on an Indonesian tax-related database. The exact number of affected records remains unknown, though the listing specifically references NPWP taxpayer identification numbers. Available reporting describes the data as internal files rather than a simple database dump. No evidence has surfaced that the attackers have published the full dataset publicly, but the threat of selective release or sale persists. The incident follows the group’s typical pattern of posting proof of compromise and waiting for payment before escalating.

Why This Matters for You and Your Family

If your Indonesian tax records were among those taken, the exposure of your NPWP number creates a direct link between your real identity and any other personal data already circulating online. Criminals can combine a taxpayer ID with an email address, phone number, or date of birth to open accounts, file fraudulent tax returns, or impersonate you with government agencies. For families, a single breach can affect spouses and dependents whose records are often linked through shared addresses or joint filings. Once your NPWP is loose, it becomes a permanent anchor for identity thieves who rarely delete stolen data.

The Doxxing and Identity-Chain Implications

An exposed NPWP does not stop at tax fraud. It can be cross-referenced with breached gaming accounts, social-media handles, or school records to build a complete profile of you and your children. Credential leaks of this nature frequently cascade into account takeovers because people reuse the same passwords across tax portals, email, and online games. Public reporting shows that children’s gaming accounts are regularly targeted once a family address or parent’s identity is confirmed. The result is doxxing chains that expose home addresses, phone numbers, and photos within days of the initial leak.

Babuk2 Group Track Record

Public reporting attributes the babuk2 ransomware group’s emergence to 2021. The group has claimed responsibility for attacks on hospitals, municipalities, and private companies across multiple countries. Notable prior victims include healthcare providers and local governments where patient or citizen records were allegedly stolen. Their typical playbook begins with initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of sensitive files and deployment of ransomware. If payment is not received, babuk2 publishes samples on their leak site and threatens full data release, often setting short deadlines to pressure victims.

What to do

• Run a DoxxScan to map every link between your NPWP, emails, phone numbers, and real identity, with cleanup of findings.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used on Indonesian government portals anywhere else it is reused, and switch to 2FA via an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or identity.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your accounts.

The exposure of taxpayer identification numbers shows how quickly government data leaks can reach criminals who never stop refining their attacks. Starting protective measures now limits the damage from both this incident and the ones that will inevitably follow. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage including children’s gaming accounts that are often the weakest link in family doxxing chains.