Pertamina · Breach

RansomHouse claims disclosure of stolen Pertamina data

Nov 02, 2026 · 1 min read

The RansomHouse extortion group moved its Pertamina listing to disclosed status, the label it uses when publishing stolen data. The group claims a breach on August 21 and first listed the Indonesian state oil and gas company in mid-September; earlier samples were reported to include finance, HR, maintenance, refinery and pipeline documents. Pertamina has not confirmed the scope of any theft; partners and staff should watch for phishing using the company's branding.

By HIFY Radar newsroom Updated 11/02/2026 12:25 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The RansomHouse extortion group marked its stolen Pertamina data as disclosed, the label it uses when publishing stolen files. The group claims a breach on August 21 and first listed Indonesia's state-owned oil and gas company in mid-September. Pertamina has not publicly confirmed the scope of any theft.

Why it matters

Finance, HR, maintenance, refinery and pipeline documents may have been published. Contractors, partners and current or former staff could face phishing using Pertamina branding or internal document references. No operational outage has been reported.

What to do

Warn teams about phishing using Pertamina branding or internal document references. If your company works with Pertamina, monitor the leak to confirm the scope of exposed data.

For the technical team

Affected: Pertamina, estatal de petróleo e gás da Indonésia; dados roubados publicados pelo grupo RansomHouse, com documentos fina · Pertamina, Indonesia's state-owned oil and gas company; finance, HR, maintenance, refinery and pipeline documents
Exploitation: No technical details. Publication is an unverified RansomHouse claim; Pertamina has not confirmed scope. Source: DailyDarkWeb on X.
Fix: Not applicable; data breach case.
More details: RansomHouse first listed Pertamina in mid-September and claims a breach on August 21. Per DailyDarkWeb, the move to disclosed status suggests a larger set of files may have been released.