Otoritas Jasa Keuangan (OJK), Indonesia’s Financial Services Authority, has told banks to step up security monitoring and to hold unusual transactions for checking. The order came as cyberattack attempts against the country’s financial sector climbed sharply over the weekend of November 7 to 9, 2026. OJK and Bank Indonesia have both activated their cyber incident response teams. No confirmed breach or customer loss has been reported.
Key Facts At A Glance
- Indonesia’s banking, finance and insurance sectors faced more than 1.2 million cyberattack attempts in a 24-hour period ending Monday evening, November 9, 2026, according to FortiGuard Labs data.
- Over the same period, the technology sector recorded about 434,000 attempts and the government sector about 163,000.
- OJK’s banking IT supervisors have been coordinating with IT staff at all banks since Friday, November 6.
- OJK sent bank directors letters with technical instructions, including closer monitoring of significant transactions and holding anomalous ones until verified.
- OJK and Bank Indonesia activated their Cyber Incident Response Teams (Tim Tanggap Insiden Siber, TTIS).
- PT Bank CIMB Niaga Tbk said it is monitoring the situation and has issued new security patches in line with OJK’s instructions.
- No breach, affected institution or customer loss has been publicly confirmed.
Indonesia’s financial regulator has put the banking sector on heightened alert after a sudden rise in attempted cyberattacks. FortiGuard Labs, the threat intelligence arm of Fortinet, recorded more than 1.2 million cyberattacks on Indonesia’s banking, finance and insurance sectors in the 24 hours to Monday evening. The technology sector recorded 434,000 attacks and the government sector 163,000. The banking figure rose from 657,000 over the weekend. Separately, Kaspersky ranked Indonesia as the 32nd most-attacked country in the world on Monday.
These figures count attempted attacks recorded by threat-monitoring dashboards. They are not confirmed intrusions. Publicly available information on the origin, method and outcome of the attacks remains limited.
Regulator Response
Dian Ediana Rae, OJK’s Chief Executive of Banking Supervision, said that since the previous Friday, OJK’s banking IT supervisors had coordinated with IT staff at all banks to raise their alertness. He described OJK as “concerned” about the issue.
He said OJK has sent several letters to bank directors about cybersecurity. The most recent, sent the week before, told bank management to stay on standby for cyberattacks and to take preventive measures. The letter includes technical instructions, such as monitoring significant transactions and temporarily holding anomalous transactions until they are verified.
Dian also pointed to existing obligations. Under digital resilience rules, banks must routinely run penetration tests, cyberattack simulations and technology audits. OJK and Bank Indonesia have both activated their Computer Security Incident Response Teams, known locally as TTIS.
The regulator also issued guidance to the public. OJK urged people to stay calm, keep transacting as usual, follow each bank’s account security protocols, and rely only on banks’ official channels rather than speculative news.
Government And Industry Reaction
Airlangga Hartarto, Coordinating Minister for Economic Affairs, said the incidents “test the ability of our system” and urged banks to strengthen their cybersecurity.
Lani Darmawan, president director and CEO of PT Bank CIMB Niaga Tbk, said the bank is monitoring the situation. It is taking preventive steps, including issuing new security patches in line with the regulator’s instructions. She said the bank remains “safe” and urged customers to follow security protocols. No other banks have publicly commented in the reporting reviewed.
What Remains Unconfirmed
As of publication, no regulator, bank or government agency has publicly confirmed that any attack succeeded. None has named an affected institution or reported customer losses or data exposure. The origin and nature of the attacks have not been disclosed.