{"id":711,"date":"2026-08-04T15:30:00","date_gmt":"2026-08-04T15:30:00","guid":{"rendered":"https:\/\/cyberasia.io\/article\/data-breaches\/cyber-team-indonesia-claims-leak-of-200000-alleged-icmr-records\/"},"modified":"2026-08-17T11:08:00","modified_gmt":"2026-08-17T11:08:00","slug":"cyber-team-indonesia-claims-leak-of-200000-alleged-icmr-records","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/data-leak\/cyber-team-indonesia-claims-leak-of-200000-alleged-icmr-records\/","title":{"rendered":"Cyber Team Indonesia Claims Leak of 200,000 Alleged ICMR Records"},"content":{"rendered":"

\u26a0\ufe0f THREAT INTELLIGENCE ADVISORY:<\/strong>
\nA threat actor identifying itself as Cyber Team Indonesia<\/strong> has claimed responsibility for leaking an alleged database belonging to the Indian Council of Medical Research (ICMR). The group shared a public download link containing approximately 200,000 CSV records exposing personally identifiable information (PII).<\/p>\n

\"Cyber<\/p>\n

If authenticated, the exposure of these sensitive medical and demographic records could facilitate widespread identity theft, targeted phishing campaigns, and severe social engineering attacks against the affected citizens. Defenders and healthcare organizations must remain vigilant.<\/p>\n

Context and Threat Actor Claims<\/h2>\n

The leak surfaced via the threat actor\u2019s primary communication channels, where Cyber Team Indonesia<\/strong> boasted that \u201cIndia\u2019s headquarters has been leaked.\u201d The group, aligning itself with broader anti-India hacktivist operations (using tags such as #OPINDIA and #ANTI_INDIA), provided a direct file-sharing link via MediaFire. The leaked file, named ICMR-Of-india.txt<\/code>, is approximately 21 MB in size.<\/p>\n

\"Cyber<\/p>\n

Figure 1: The official announcement and download link shared by the threat actors.<\/em><\/p>\n

Crucially, ICMR has previously been linked to a major alleged data breach in late 2023 involving hundreds of millions of health records. At this time, it remains unclear whether this newly shared dataset represents a fresh compromise, a subset of previously leaked data, or recycled information repackaged by the group for geopolitical clout.<\/p>\n

Summary of the Incident<\/h2>\n\n\n\n\n\n\n
Claim \/ Threat Activity<\/th>\nSource<\/th>\nStatus<\/th>\n<\/tr>\n<\/thead>\n
Leaking of ~200,000 CSV records (21MB)<\/td>\nThreat Actor Post<\/td>\nVerified (Sample Validated)<\/td>\n<\/tr>\n
Dataset directly originates from ICMR systems<\/td>\nCyber Team Indonesia<\/td>\nUnverified<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Technical Analysis of the Exposed Data<\/h2>\n

CyberAsia examined the shared sample and confirmed it contains roughly 200,000 lines formatted as comma-separated values (CSV). However, our intelligence team could not independently verify that the dataset originated directly from ICMR. No direct evidence linking the records to specific ICMR systems or network infrastructure was found within the sample itself.<\/p>\n

Observed data fields include:<\/strong><\/p>\n

1. Demographic Identifiers:<\/strong> Full names, Father\u2019s names, Age, and Gender.<\/p>\n

2. Contact Information:<\/strong> Phone numbers, secondary\/other numbers, Residential addresses, District, Postal code, State, and Town\/City.<\/p>\n

3. Sensitive National IDs:<\/strong> Passport numbers and Aadhaar numbers.<\/p>\n

Mitigation Recommendations<\/h2>\n
    \n
  1. Verify Source Authenticity:<\/strong> Organizations handling national health data must cross-reference the leaked sample against internal databases to determine if it stems from a fresh intrusion or a historical breach.<\/li>\n
  2. Implement Dark Web Monitoring:<\/strong> Proactively scan underground forums and file-sharing networks for the proliferation of this specific dataset to assess secondary risks.<\/li>\n
  3. Enforce Fraud Protection:<\/strong> Given the exposure of Aadhaar and Passport numbers, citizens should be alerted to the heightened risk of financial fraud and identity theft.<\/li>\n
  4. Review Vendor Access:<\/strong> As many historical breaches stem from third-party compromises, audit all external vendors with access to medical demographic databases.<\/li>\n<\/ol>\n

    At the time of writing, no official statement from the ICMR or the Indian government was available regarding this specific claim. We will continue monitoring the activities of Cyber Team Indonesia<\/strong>. For related coverage, see our data breach intelligence updates<\/a>.<\/p>\n

    \n
    \n

    > subscribe_to_intel<\/h3>\n

    Get CyberAsia threat intelligence updates by email. Unsubscribe anytime. Privacy Policy<\/a>.<\/p>\n

    \n