Key Takeaways
- Bank Syariah Indonesia (BSI) was attacked by LockBit ransomware in May 2023, disrupting banking services for millions of Indonesian customers
- LockBit claimed to have stolen the personal and financial information of about 15 million customers and employees, along with internal documentation
- The attack took BSI's mobile banking and ATM services offline for several days — affecting the bank's 15 million+ customer base
- The attack came months after Indonesia's OJK (Financial Services Authority) issued cyber-resilience rules for commercial banks (SEOJK 29/SEOJK.03/2022)
- BSI is Indonesia's largest Islamic bank, making the attack a high-profile test of Indonesian financial sector resilience
The Facts
When customers of Bank Syariah Indonesia tried to access their accounts through mobile banking on the morning of 8 May 2023, many found themselves locked out. The disruption that followed — lasting several days and affecting ATM networks, mobile banking, and branch operations — would become one of Indonesia's most significant financial sector cybersecurity incidents.
LockBit ransomware — at the time the world's most prolific ransomware group — claimed responsibility. The group published what it described as samples of stolen data and alleged that it had exfiltrated the personal and financial information of about 15 million customers and employees, together with internal banking documentation.
BSI's 15 million+ customer base — consisting primarily of Indonesian Muslims using Islamic banking services — was left without full banking access during the operational recovery period. BSI initially attributed the outage to system maintenance before acknowledging indications of a cyberattack, and switched off several channels while it restored core banking services.
LockBit's international law enforcement disruption in February 2024 eventually took down significant portions of its infrastructure, but the group has shown partial reconstitution capabilities — and data already leaked before that operation could not be recalled.
Technical Deep-Dive
Large financial institution ransomware attacks typically follow a patient, multi-stage timeline. Initial access at BSI was likely achieved through phishing, compromised credentials, or exploitation of exposed external services — the three dominant initial access vectors for financial sector intrusions in the 2022-2023 period.
Following initial access, the dwell phase — during which LockBit affiliates conducted network reconnaissance, identified high-value data stores, mapped backup systems, and prepared the encryption deployment — likely extended over weeks or months before the May 8 visible attack. During such a phase, data is typically copied to attacker-controlled infrastructure, leaving no immediate operational indicator of the ongoing exfiltration.
The deployment of the encryption payload — the moment the attack became visible — was timed to maximise ransom pressure: a Monday morning when banking activity peaks and operational disruption creates immediate customer-facing impact.
Indonesian banking sector IT architecture typically involves core banking systems with external-facing APIs for mobile banking and internet banking portals. Lateral movement from a compromised perimeter system to the core banking infrastructure, while technically challenging, is achievable in environments without rigorous network segmentation.
The ASEAN Perspective
The BSI attack was a high-profile test for Indonesian financial sector cybersecurity. It came months after OJK issued its cyber-resilience and security rules for commercial banks (SEOJK 29/SEOJK.03/2022), and it put those requirements, and banks' compliance with them, under public scrutiny.
For ASEAN's broader banking sector, the incident illustrates the targeting of Islamic banking institutions — a growing financial sector segment in Indonesia (world's largest Muslim-majority nation), Malaysia, Brunei, and parts of Thailand. LockBit and successor groups have shown no distinction in targeting between conventional and Islamic banking.
RECATOOLS Verdict
The BSI breach is a case study in the real operational cost of ransomware beyond the ransom demand: days of customer service disruption, reputational damage in a competitive banking market, regulatory scrutiny, and the long-term risk from data that LockBit says it leaked. The total cost substantially exceeds any ransom demand.
Sources
- CSIS Significant Cyber Incidents Timeline 2023
- Positive Technologies ASEAN Cyberthreats 2023-2024
- OJK Circular Letter SEOJK 29/SEOJK.03/2022 on cyber resilience and security for commercial banks
FAQ
What happened to Bank Syariah Indonesia? LockBit ransomware attacked BSI in May 2023, disrupting mobile banking and ATM services for several days and claiming to have stolen 15 million customer records.
What is BSI? Bank Syariah Indonesia — Indonesia's largest Islamic bank, formed through the merger of three state-owned Islamic banking units, with over 15 million customers.
Was the ransom paid? BSI did not publicly disclose its ransom decision. LockBit published what it said were negotiation logs and leaked the data after talks broke down.
What happened to LockBit? LockBit's infrastructure was disrupted by international law enforcement in February 2024, though the group has shown partial operational reconstitution since.
What changed in Indonesian banking security after the attack? OJK's cyber-resilience rules for commercial banks (SEOJK 29/SEOJK.03/2022) were issued months before the attack, which put those requirements, and banks' compliance with them, under public scrutiny.
Correction, 18 October 2026: An earlier version said BSI acknowledged the attack and that OJK issued new guidance after it; BSI initially attributed the outage to maintenance, and OJK's cyber-resilience rules for banks predate the incident. LockBit's claim covered customers and employees, and an unsupported statement about Bank Indonesia regulations has been removed.
View author profile → · Editorial policy
