Indonesian Banks on 24-Hour Cyber Alert: What to Do Now

Indonesia’s Financial Services Authority (OJK) has asked every bank to stay on 24-hour alert as a wave of cyberattacks hits the financial sector. Banks must watch for anomalies and may hold suspicious transactions until they are verified. On November 10, 2026, the national cyber agency BSSN said it had sent threat warnings to the sector through its incident response teams.

The move follows a string of attacks on banks in several countries over the past two weeks. OJK says the national banking system is safe so far. Even so, findings from an Indonesian incident response firm show that funds have already been stolen from local financial institutions since August, using methods that every bank, rural bank, and fintech company should check against its own systems.

What OJK and BSSN did this week

Dian Ediana Rae, OJK’s chief executive for banking supervision, said the regulator’s IT supervisors have been coordinating with IT staff at all banks since Friday, November 6, 2026. According to CNBC Indonesia, OJK has also written to bank boards several times. The latest letter, sent last week, asked management to stay alert and take preventive steps.

In a written statement reported by Katadata, Dian said OJK wants banks to be on alert around the clock to monitor every anomaly. Banks are expected to watch significant transactions and temporarily stop unusual ones until they are clarified. OJK and Bank Indonesia have also activated a Cyber Incident Response Team (TTIS) for the banking sector.

BSSN spokesperson Prabaswari said threat notifications are being sent through the TTIS network. According to Katadata, BSSN has set up 151 TTIS units in the financial sector. Throughout 2026 it has sent 202 notifications to financial organizations that may be affected and published 208 security advisories. On November 9, Coordinating Minister for Political and Security Affairs Dudung Abdurachman chaired a meeting with BSSN and the banking industry to assess the impact of the global attacks.

Reading the “millions of attacks a day” figures

Several outlets have cited a Fortinet FortiGuard Labs dashboard showing millions of attack attempts on Indonesia within 24 hours. The number shifts depending on when the dashboard is checked. Katadata recorded about 1.6 million attempts at 7:00 a.m. Western Indonesia Time on November 9, while CNBC Indonesia cited about 350,600 attempts in the 24 hours to November 7.

BSSN stressed that these figures reflect attack activity detected by Fortinet security devices. They do not count successful intrusions. For IT teams, the daily totals are better read as a sign that automated scanning is running at high volume, which means unpatched weaknesses are found faster.

The trigger overseas

Concern rose after French cooperative bank Crédit Mutuel Arkéa disclosed a cyberattack on November 4, 2026. According to BleepingComputer, the bank said the attacker reached its network through a third-party service provider’s platform. The attacker then used the bank’s own account to transact with other financial institutions and converted the funds into cryptocurrency.

The size of the loss is still unclear. Blockchain investigator ZachXBT estimated that up to 118 million euros, or about $133 million, was taken. Republika reported a figure of around 100 million euros. Crédit Mutuel Arkéa has not confirmed either number and said it could only validate the order of magnitude. The bank says customer assets were not affected, although some transfers were delayed after certain transactions were paused.

The case carries a direct lesson for Indonesia. The attacker’s access came through a technology partner, and the money left through the bank’s own payment channels. Monitoring that only watches customer accounts can miss movements from an institution’s operational accounts.

Patterns from three Indonesian cases

At home, incident response firm ZENTARA has described three cases of funds theft at Indonesian financial institutions since August. The institutions were not named. According to the firm’s press release, as reported by Katadata, the three used different vendors, technology, and staff, yet their weaknesses were similar.

The attackers got in with valid access: stolen signing keys, staff tokens, and genuine back-office accounts. In each case, money was moved between 36 minutes and nearly seven hours after the first fraudulent transfer, through the institution’s own payment system to domestic accounts held in other people’s names.

ZENTARA identified several controls that existed on paper but failed in practice:

• Flawed maker-checker approval. In one system, approval only counted the number of signatures and never checked who had signed.
• Secrets stored in logs. Monitoring and analytics tools kept passwords, tokens, and two-factor authentication (2FA) secrets. Anyone able to read the logs could potentially take over administrator access.
• Missing logs. In three of five incident response and compromise assessments, ZENTARA could not determine how the attackers first got in because logs had never been kept.
• No automatic alarm. In the documented cases, no alert fired on its own. In one incident, staff who spotted the attack shut the platform down within 29 minutes and blocked further withdrawals.

One institution was breached again eight days after the initial response. ZENTARA also cited Indonesia Anti-Scam Centre (IASC) data showing that 85 percent of fraud victims only report after 12 hours. When money can move within minutes, detection speed inside the institution decides the outcome.

These findings match an earlier Merakit piece on AI-powered attacks and the shrinking patch window. Attackers now find old weaknesses faster, while many organizations still patch on a monthly cycle.

What this means for banks, rural banks, and fintechs

Large banks generally run their own security operations centers. The greater risk sits with institutions that have small IT teams, such as rural banks (BPR), savings and loan cooperatives, and fintech companies whose payment systems were built quickly. These are concrete steps that can be taken this week.

1. Test the transfer approval flow. Create a test transaction and confirm the system rejects it when the maker and the checker are the same person or account. Make sure the identity of every approver is recorded.
2. Remove secrets from logs. Search application and monitoring logs for passwords, API tokens, signing keys, and 2FA secrets. If any turn up, purge them and rotate every affected credential.
3. Centralize log storage. Ship logs to a location that application accounts cannot modify, and keep them long enough to support an investigation.
4. Set transaction alerts. Write simple rules that flag large transfers to new accounts, activity outside office hours, or recipient names that do not match the account holder.
5. Review partner access. List every vendor with access to the network or payment systems, narrow their permissions, and require multi-factor authentication.
6. Rehearse stopping a transfer. Simulate who has the authority to halt a payment, through which channel, and how long it takes. OJK’s instruction to hold suspicious transactions only works if the procedure has been practiced.

For developers of financial applications, steps 1 to 4 belong in the system design from day one. Merakit covers this approach in its financial services solutions, which include approval workflows, transaction monitoring, and audit logging.

For customers, OJK asks the public to stay calm, keep transacting as usual under their bank’s security protocols, and communicate with banks only through official channels. Cybersecurity analyst Alfons Tanujaya added that customers should turn on 2FA and never share one-time passwords with anyone.

Frequently asked questions

Has any Indonesian bank been breached in this wave?

OJK says the national banking system is safe so far and has not named any bank that was breached. The three cases described by ZENTARA date back to August, and the institutions involved were not identified.

Is customer money safe?

In the Crédit Mutuel Arkéa case, the attacker used the bank’s own account, and the bank says customer assets were not affected. In Indonesia, OJK has asked customers to keep using their banks as normal, protect their one-time passwords, and check account statements regularly.

What is a TTIS?

TTIS stands for Tim Tanggap Insiden Siber, a cyber incident response team that receives alerts, coordinates, and handles incidents within an organization or sector. BSSN uses the TTIS network to distribute threat notifications, and OJK and Bank Indonesia have activated one for the banking sector.

Closing thoughts

This wave of attacks shows that controls written into policy documents need to be tested on live systems. Layered approvals, clean logs, and transaction alerts can all be checked within days. If your team wants to review its payment flows or set up security monitoring, Merakit’s cybersecurity team is ready to talk.

Sources

• OJK Minta Bank-Bank Siaga Penuh, Ancaman Hacker Makin Ganas, CNBC Indonesia, November 9, 2026
• Gelombang Peretasan Global, OJK Minta Perbankan Indonesia Tingkatkan Kewaspadaan, Katadata, November 9, 2026
• OJK Minta Bank Siaga 24 Jam Antisipasi Serangan Siber, Republika, November 9, 2026
• 1,6 Juta Serangan Siber Ancam RI 24 Jam Terakhir, Sektor Keuangan Paling Banyak, Katadata, November 9, 2026
• Hadapi Serangan Siber, BSSN & Perbankan Nasional Perketat Pertahanan, CNBC Indonesia, November 9, 2026
• BSSN Respons Serangan Siber, Bentuk Tim dan Kirim Notifikasi ke Sektor Keuangan, Katadata, November 10, 2026
• Hacker Kuras Uang Tiga Lembaga Keuangan Indonesia dalam 7 Jam, Ini Modusnya, Katadata, November 10, 2026
• Hackers pull off $133 million French bank heist via service provider, BleepingComputer, November 7, 2026