A threat actor claims to be selling highly sensitive data from the Badan Intelijen Strategis (Indonesian Military Strategic Intelligence Agency) and the Indonesia Automatic Fingerprint Identification System (INAFIS).
Badan Intelijen Strategis Data
The threat actor has allegedly posted a sample of the data for download and is offering the full dataset for sale. The Strategic Intelligence Agency is responsible for military intelligence and operates under the command of the Indonesian National Army Headquarters.
Compromised Files:
- 2,000 user database (.SQL) containing data such as:
- id, name, task force, rank, username, email, password, avatar, tokens, phone number, IMEI, last seen, generation, NRP, device, manufacture, OS, app version
- Confidential (secret) documents from military intelligence members (.PDF and .DOC) from 2020 to 2022
Pricing:
- User database files (.SQL), 773KB: $1,000
- Secret documents (.ZIP), 33.7GB: $7,000
- Free sample data available on the forum
The threat actor states that they are accepting payments only in cryptocurrency, specifically XMR (Monero), and can be contacted via Telegram.
INAFIS Data
The same threat actor also claims to be selling data from INAFIS (Indonesia Automatic Fingerprint Identification System), which is crucial for the identification process through fingerprints and focuses on collecting authentic data on the Indonesian population.
Compromised Files:
- INAFIS faces member images (.PNG) with email
- INAFIS fingerprints member images (.WSQ) with email
- INAFIS SpringBoot application (.JAR) with database configuration properties
Pricing:
- INAFIS SpringBoot application with configuration: $1,000
- Potential to access API/DB with 200+ million Indonesian ID card numbers through reverse engineering the application
The threat actor further claims that anyone interested in the INAFIS data can contact them via Telegram.
The severity of these breaches highlights significant security vulnerabilities and the potential for misuse of sensitive military and biometric data.
