Sri Rakum School for the Blind Targeted in Data Leak by Dewata Blackhat

⚠️ DATA BREACH ADVISORY:
The Sri Rakum School for the Blind, a non-profit charitable educational institution based in India, has fallen victim to a database compromise. The pro-Indonesian hacktivist group Dewata Blackhat, operating through the alias ./KeraSakti, has published the institution’s user database online.

The leak, distributed via a public cloud-sharing platform, includes personal identifiable information (PII) and authentication credentials belonging to the school’s digital management portal. Threat intelligence monitors identified the leak on Telegram channels associated with regional hacktivist syndicates.

Exposed Data Categories and Technical Impact

Analysis of the leaked CSV file indicates that the compromised database table contains structured administrative and user account data. The exfiltrated data categories include:

• User Identifiers (user_id): Unique index keys for registered accounts.
• User Designations (user_type): Structural roles within the platform, exposing administrative versus standard user permissions.
• Full Names (user_firstname, user_lastname): Legal names of staff, donors, or students registered in the system.
• Electronic Mail Addresses (user_email): Active email addresses used for account registration and communications.
• Plaintext/Hashed Credentials (user_password, user_password1): Password strings utilized to gain access to the application. The presence of double password columns suggests either a configuration logging error or password confirmation cache exposure.

Targeting Shift: The Ethical Limits of Regional Hacktivism

While regional hacktivist groups in Southeast Asia historically frame their operations around political or nationalistic motivations, the targeting of humanitarian and charitable organizations like the Sri Rakum School for the Blind marks a shift in tactical constraints. These institutions frequently operate on limited cybersecurity budgets, leaving them highly vulnerable to basic SQL injection (SQLi) or credential exploit vectors.

Cooperating networks behind these campaigns, such as the Akatsuki Cyber Team and Bangladesh Anonymous, leverage these low-security targets to inflate their data leak volume counts, despite the lack of geopolitical significance or financial gain.

Recommended Defense Hardening

Due to the exposure of plain user credentials and associated email addresses, immediate mitigation is required to protect the affected domain and prevent secondary lateral compromises:

• Domain-Wide Credential Revocation: Invalidate all active passwords on the rakum.org domain and require users to establish new, strong credentials.
• Implement Input Sanitization: Audit database input fields to ensure parameter validation is enforced, preventing SQL injection vulnerabilities that allow direct database dumping.
• Credential Stuffing Protection: Since the leaked passwords may be reused across other personal or financial services, users registered under the school’s platform should immediately update credentials on external sites sharing the same password.

Charitable and educational institutions are urged to implement basic secure web application frameworks to reduce their attack surface against automated exploit scans.

Mitigation & Prevention Strategies

Data breaches involving Personally Identifiable Information (PII) or sensitive corporate databases require immediate containment and long-term security overhauls:

• Database Hardening: Ensure databases (SQL, MongoDB, Elasticsearch) are never exposed directly to the public internet. Bind services to localhost or strict internal VPCs.
• Data Encryption: Implement robust encryption for data-at-rest. Even if threat actors exfiltrate database dumps, properly salted and hashed passwords minimize the blast radius.
• Credential Rotation: Following any suspected breach, force a global password reset for affected users and rotate API keys and service credentials immediately.

Strategic Threat Landscape & Operational Technology (OT) Vulnerabilities

The escalation of this specific cyber incident reflects a broader, systemic shift in the global threat landscape regarding the targeting of Operational Technology (OT) and critical infrastructure. Threat intelligence analysts continuously observe that the tactics, techniques, and procedures (TTPs) deployed here represent a severe escalation in cyber-physical risks.

In recent months, the rapid digitization of industrial environments—often referred to as Industry 4.0—has inadvertently expanded the attack surface of once-isolated SCADA systems and Industrial Control Systems (ICS). The convergence of IT and OT networks has allowed threat actors to pivot from compromised corporate environments directly into environments controlling physical processes, power grids, and manufacturing lines.

Furthermore, the exploitation of unpatched IoT devices, exposed HMIs (Human-Machine Interfaces), and legacy protocols lacking native encryption has become a preferred vector for both financially motivated syndicates and state-aligned disruption teams. These intrusions are often designed to inflict maximum operational downtime and societal impact.

Defensive Evolution & The Purdue Enterprise Reference Architecture

From a defensive standpoint, applying traditional IT security models to OT environments is fundamentally flawed. Organizations must urgently adopt and strictly enforce the Purdue Enterprise Reference Architecture (PERA), ensuring rigorous network segmentation and the implementation of industrial DMZs.

To combat this evolving threat matrix, the deployment of passive, ICS-specific Deep Packet Inspection (DPI) is critical for identifying anomalous lateral movement without disrupting fragile legacy equipment. Proactive threat hunting, continuous vulnerability management, and strict access controls are the most effective strategies for maintaining organizational resilience against cyber-physical adversaries.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.