On Thursday, 20 June 2024, immigration services at several Indonesian airports were disrupted. Four days later, the head of the National Cyber and Crypto Agency (BSSN) said the disruption at the National Data Centre (PDN) was caused by a ransomware attack named Brain Cipher, the latest development of the LockBit 3.0 ransomware, which encrypted the data inside (Sutrisna, 2024a). The Ministry of Communication and Informatics reported that the attack disrupted services at 210 central and regional agencies, with immigration services hit hardest, and that the attackers demanded a ransom of 8 million US dollars (Sutrisna, 2024b).
The attack hit government agencies, but the questions it raises apply to any company that has moved work permits, inspections, training and incident reports into an app. Below are five questions that often come up, answered with the information available up to 26 June 2024.
What Happened?
According to BSSN's preliminary forensic analysis, attempts to disable the Windows Defender security feature began on 17 June 2024 at 23.15 WIB. Malicious activity started on 20 June at 00.54 WIB, including installing malicious files, deleting important system files and stopping running services. The Temporary National Data Centre service is supported by two data centres in Tangerang and Surabaya and a cold-backup disaster recovery centre in Batam, and the attack on the Surabaya facility affected 282 tenants (Pertiwi, 2024).
On 26 June the operator said the encrypted data could not be recovered and that the system had been isolated. The first recovery stage targeted around 44 tenants with backups in Surabaya and Batam. Some tenants had backups, others had none or could not yet verify them, and by that day only five services had been restored (Nurhapy, 2024). The investigation is still under way, so we do not assess the technical cause any further.
Why OHS Should Care
Many companies now keep OHS data in apps: work permits, equipment inspection results, training certificates and their expiry dates, worker health data and incident reports. In our view these data differ from ordinary administrative records because some of them drive safety decisions on the same day, such as whether hot work or a confined space entry may start. When the app is unavailable, the risk is not only late reporting but high-risk work going ahead without the checks it should have.
There is a second side that is easy to overlook. The PDN disruption lasted for days, and on 26 June most services had still not been restored (Nurhapy, 2024). An outage that long in an OHS app means inspection, training and incident records from the outage period have to be collected by hand and entered later, which makes them easy to lose or duplicate without a clear procedure.
Isn't There a Backup?
Having a backup does not guarantee recovery. The PDN case shows that some tenants had no backup or could not verify it (Nurhapy, 2024). The NIST Cybersecurity Framework 2.0 treats this as two separate outcomes: backups of data are created, protected, maintained and tested (PR.DS-11), and the integrity of backups is verified before they are used for restoration (RC.RP-03) (National Institute of Standards and Technology [NIST], 2024). In other words, a backup needs to be tested by actually restoring it, not just recorded as existing.
Is the Cloud Safer?
There is no single answer. The PDN case shows that when many users rely on one provider, one attack can disrupt hundreds of services at once (Pertiwi, 2024). CSF 2.0 places cybersecurity supply chain risk management within its GOVERN function, alongside IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER (NIST, 2024). In our view, companies using cloud-based OHS apps still need to know where their data is stored, who makes the backups, how often, and how the company can take its own copy of the data.
What Should Teams Prepare?
- Define the critical OHS data, such as the register of active work permits, emergency contacts, safety data sheets and the status of equipment due for inspection, and keep a current copy outside the main system.
- Prepare a temporary manual procedure, such as paper permit forms and an approval route, for use when the app cannot be reached.
- Test backup restoration regularly and record how long it takes before the data can be used again.
- Limit administrator rights and monitor changes to security settings, since the PDN attack was preceded by attempts to disable a security feature about two days before the malicious activity began (Pertiwi, 2024).
- Make sure the contract with the app provider states the backup schedule, storage location, recovery time target and how the company can download its own data.
- Add a digital system outage scenario to the business continuity plan and emergency response exercises.
How Nusa Safety Helps
Nusa Safety helps companies design digital OHS that keeps working when systems fail, through HSE Digitalization and custom HSSE software development, including backup and data export arrangements. The Nusa Safety team can also develop SOPs and technical guidelines for temporary manual procedures such as paper work permits.
This article is general information and not legal or professional advice for any specific case.
References
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
- Nurhapy, M. F. (2024, June 26). Data di Pusat Data Nasional yang diserang ransomware tidak bisa dipulihkan [Data at the ransomware-hit National Data Centre cannot be recovered]. Kompas.com. https://tekno.kompas.com/read/2024/06/26/18535887/data-di-pusat-data-nasional-yang-diserang-ransomware-tidak-bisa-dipulihkan
- Pertiwi, W. K. (2024, June 26). BSSN ungkap kronologi serangan ransomware PDNS, diawali peretasan Windows Defender [BSSN sets out the timeline of the PDNS ransomware attack, which began with tampering with Windows Defender]. Kompas.com. https://tekno.kompas.com/read/2024/06/26/13000097/bssn-ungkap-kronologi-serangan-ransomware-pdns-diawali-peretasan-windows
- Sutrisna, T. (2024a, June 24). BSSN: Gangguan Pusat Data Nasional disebabkan serangan siber ransomware [BSSN: National Data Centre disruption caused by a ransomware cyberattack]. Kompas.com. https://nasional.kompas.com/read/2024/06/24/14232651/bssn-gangguan-pusat-data-nasional-disebabkan-serangan-siber-ransomware
- Sutrisna, T. (2024b, June 24). Serangan siber ke Pusat Data Nasional ganggu layanan 210 instansi pemerintah [Cyberattack on the National Data Centre disrupts services at 210 government agencies]. Kompas.com. https://nasional.kompas.com/read/2024/06/24/16523691/serangan-siber-ke-pusat-data-nasional-ganggu-layanan-210-instansi-pemerintah
