Komdigi Warns Indonesian Government Sites of Threatened Cyberattacks Over Digital Tax

Indonesia's Ministry of Communication and Digital Affairs (Komdigi) has told ministries, agencies, regional governments and electronic system operators to tighten their security after threats of cyberattacks on government services circulated on social media. The threats are framed as opposition to SPP-TDLN, the system for collecting VAT on foreign digital transactions. None of the reports cites an attack linked to them, and the National Cyber and Crypto Agency (BSSN) says neither the threat nor the attackers' capability has been verified.

The advisory and the letters

Komdigi's press release cites a BSSN security advisory issued on 8 November through Gov-CSIRT Indonesia, which says the authenticity of the threat is "belum terverifikasi" (unverified). The next day the ministry's digital government technology directorate sent three advisory letters: to users of the National Data Centre (PDN-1) and Government Cloud, to the officials who run government domain names, and to public-sector system operators.

The letters name DDoS, defacement, exploitation of security flaws, DNS hijacking and phishing as the likely forms of attack. Neither Komdigi nor BSSN has named the group behind the threat, which Katadata says spread through social media.

What operators are asked to do

Komdigi wants incident response teams ready, closer monitoring of network traffic and vulnerability checks. It also asks for "memperkuat autentikasi akun administrator, memperbarui perangkat lunak" (stronger administrator authentication and updated software), better DDoS protection, and backups and recovery procedures that work. PDN-1 and Government Cloud users report incidents to PDN-CSIRT at csirtpdn.layanan.go.id.

Deputy Minister Nezar Patria said the ministry was "menunggu juga arahan dari BSSN" (also waiting for BSSN's direction).

The tax behind it

The tax directorate says SPP-TDLN "bukan pajak baru" (isn't a new tax) and doesn't change the VAT rate; it appointed six institutions as VAT collectors under the system, which took full effect on 9 November.

What the public is told

The ministry tells people not to open suspicious links or hand over passwords and personal data, and to reach government services only through their official website addresses.