Ransomware group dragonforce hits PLN
PLN — a energy target operating in ID has been listed by the dragonforce ransomware group on 2025-03-31. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | PLN |
|---|---|
| Threat Group | dragonforce |
| Summary | PLN, a energy organization in Indonesia, was listed by the dragonforce ransomware group on its leak site on 2025-08-21. |
| Date of Breach | 2025-03-31 |
| Discovery Date | 2025-08-21 |
| Region | ID |
| Target Domain | www.pln.co.id |
| Business Sector | Energy |
| Severity | MEDIUM |
Claim by dragonforce
Core business is the supply of electricity, especially in generation, transmission and distribution. Obtaining the task of electrifying all over the archipelago, PLN has the obligation to increase installed capacity for power supply and the development of electricity infrastructure such as transmission networks, substations, and distribution networks. At all times, we continue to improve ourselves and improve services, considering that electricity is a basic infrastructure need that will create a multiplier effect for the progress of the Indonesian economy. Our business continues to expand into various business sectors through subsidiaries, associated entities, joint ventures, and special purpose vehicles (SPV) under the auspices of the PLN Group. Through the implementation of SOLID (Securing Business Sustainability, Optimizing Cost Efficiency, Leading Industry Capabilities, Increasing Profit Contribution and Developing New Edge) business portfolios, we will continue to develop services to become a World Class Electricity Company.
Posted by the dragonforce threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Victim website
www.pln.co.id
Leak post (onion / Tor)
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog/?post_uuid=42444dba-ad92-4aa1-ae1c-57b684adecd1
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

