-
RansomHouse moved its Pertamina listing to ‘DISCLOSED,’ suggesting the group published stolen data after no payment.
-
Researchers estimate over 6 GB of files across at least nine departments, including HR, finance, and pension records.
-
Contractors, former employees, and current staff need to be careful with attempts of phishing that use the company brand or references to internal documentation.
The RansomHouse extortion group has changed the status of its Pertamina listing to “DISCLOSED.” This label means the group has published stolen data. Pertamina is an oil and gas corporation owned by the government of Indonesia. The group was initially named Pertamina in the middle of September.
According to RansomHouse, it hacked into the systems of Pertamina on August 21, 2026. Earlier samples showed documents from the finance, HR, maintenance, refinery, and pipeline departments. Pertamina has yet to deny or confirm the claims.
What the Status Change Means
The move to ‘DISCLOSED’ suggests RansomHouse may have released a larger set of files. The group uses this label when it publishes data after a victim refuses to pay. The change does not prove the data is real. It only shows the group has taken the next step in its extortion campaign.
Security researchers have tracked the listing since mid-September. Ransomware monitoring systems observed the claim with an attack date of August 21, 2026. One of the trackers notes that the advertisement might contain more than 6 GB of data and thousands of documents from at least nine departments.
Further, the timing is significant since there were two months between the first advertisement and the change of status. That gap fits the usual extortion cycle. The group sets a deadline & waits for payment – then, it publishes when the money does not arrive.
RansomHouse has used this pattern before. The group does not maintain a leak blog with daily release of information. Rather, it posts a claim, negotiates in private, and then marks it as disclosed. Victims who pay never see that final step.
What the Leaked Files Reportedly Contain
Researchers who reviewed samples described a wide mix of documents. The files reportedly cover finance and HR records. They also include maintenance planning, refinery operations, and pipeline documents. Cybersecurity incident reports and risk analysis files are also mentioned.
According to reports, a single pension fund file contained nearly 1,600 records including details such as names, dates of birth, plus employment numbers. The range of assorted files shows that the hackers were able to gain access to a common file server. Notably, a single employee computer could not contain documents from multiple departments.
Some of the records have dates of several past years. This is significant for two reasons. Firstly, it means some of these records might no longer be in use by the company, as they are old. Secondly, it reflects the broad nature of the data of the affected people. Also, retired staff and former contractors may appear in files long after they left.
RansomHouse has also claimed attacks against other major companies. In a separate incident, not too long ago, Askul confirmed that the group stole customer data in a cyberattack.
Who Is at Risk and What They Should Do
It is important for contractors, associates, and both current and former employees to be on the lookout for phishing scams. This is due to potential misuse of the image and internal documents of the company by criminals. An SMS or communication appearing to be legitimate from the company is harder to identify. Therefore, people who receive a suspicious email must check the authenticity of the message via reliable channels.
Retirees face a higher risk than active staff. They no longer receive regular security briefings from the company. They may also have older contact details on file. A convincing fake message could catch them off guard.
Pertamina should tell affected people what was taken. It should also explain what steps the company is taking. Clear notices reduce panic and help people spot scams. A silence leaves room for criminals to fill the gap.
The breach raises questions regarding compliance with Indonesian personal data legislation. The law requires companies to notify affected individuals, as well as the authorities, within 72 hours from the moment of discovering a hack. Pertamina has not made any public statement on the notification.
Pertamina has faced multiple extortion claims this year. Another group, The Gentlemen, also listed Pertamina in July this year. That listing claimed over 1.2 TB of data. The RansomHouse claim appears separate, with a different date and file set.
Two claims in one year point to a deeper problem. Either the company suffered more than one breach, or one group sold access to another. Both possibilities suggest weak controls around third-party systems and shared files.
