LockBit 5.0 claims attack on Indonesian telecom Centratama
LockBit 5.0 ransomware listed PT Centratama Telekomunikasi Indonesia, a telecom tower and fiber network operator for mobile operators, on its data-leak site on Nov 4, 2026. No details on the volume or type of allegedly stolen data, and Centratama has not confirmed a cyber incident. Monitor official statements and watch for targeted phishing and invoice fraud.
What happened
The LockBit 5.0 ransomware group listed PT Centratama Telekomunikasi Indonesia on its data-leak site on Nov 4, 2026 (UTC). The publicly listed company runs telecom towers and fiber networks for mobile operators in Indonesia. The claim is unverified and Centratama has not confirmed a cyber incident.
Why it matters
The company is critical telecom infrastructure. According to DailyDarkWeb, a breach could expose network site data, carrier contracts, engineering documents and staff records useful for follow-on attacks on Indonesian mobile networks. Partners and staff should watch for targeted phishing and invoice fraud.
What to do
Monitor Centratama official statements and verify the claim. Alert staff and partners to targeted phishing and invoice fraud.
For the technical team
- Affected
- PT Centratama Telekomunikasi Indonesia Tbk, provedora indonésia de infraestrutura de telecomunicações listada em bolsa, · PT Centratama Telekomunikasi Indonesia Tbk, a publicly listed provider of telecom towers and fiber networks for mobile operators in Indonesia.
- Exploitation
- Unverified claim. LockBit 5.0 listed the victim on its data-leak site on Nov 4, 2026 (UTC), according to DailyDarkWeb. No details on the volume or type of allegedly stolen data.
- Fix
- No software to update
- More details
- DailyDarkWeb analyst note: potential exposure of network site data, carrier contracts, engineering documents and staff records useful for follow-on attacks on Indonesian mobile networks. LockBit has repeatedly hit Indonesian targets. Watch for targeted phishing and invoice fraud. Centratama has not publicly confirmed the incident.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb



