Indonesia has told government websites to brace for possible cyberattacks

The short version

• Komdigi, Indonesia's digital ministry, issued three warning letters on 9 November. It told public agencies and public online services to tighten security against a threatened cyberattack.
• The threat spread on social media as a protest against a new tax on foreign digital transactions. The national cyber agency, BSSN, says it is not verified.
• The ministry also warned the public about scams that use the digital tax issue. It said it is working with BSSN on attacks run by teams of AI agents.

What the ministry asked for

On 8 November, BSSN issued a security advisory through its government incident response team. A day later, Komdigi followed with three letters. One went to agencies using the national data center and Government Cloud. Another went to the officials who manage government website addresses. The third went to every operator of a public online service.

BSSN said neither the threat nor the attackers' skills had been verified. It still listed the likely forms an attack could take:

• floods of fake traffic meant to knock services offline;
• defaced websites;
• break-ins through known security holes;
• hijacked web addresses that send visitors to the wrong site;
• fake emails and false information.

Komdigi asked operators to act now. It wants incident response teams ready and stronger logins on administrator accounts. It also asked for updated software and better protection against traffic floods. Backups and recovery plans should be checked to make sure they work.

The ministry linked the threat to protests against a new system for collecting tax on foreign digital transactions. It asked the public to be careful with messages and links that claim to come from a government agency. People should never share passwords or personal data through channels they cannot verify.

The AI agent warning

In a second statement the same day, Deputy Minister Nezar Patria said Komdigi and BSSN were coordinating on a newer kind of threat. These are cyberattacks run by groups of AI agents. An AI agent is software that can carry out a series of actions on its own.

Nezar said such agents can work together, which makes attacks harder to handle. He said BSSN has run attack simulations and has strengthened parts of the national digital infrastructure. He also made the division of labor clear. Running the security of critical digital infrastructure is BSSN's job. Komdigi coordinates with the wider digital industry and follows BSSN's lead.

What it means for companies in Indonesia

The letters are aimed at public services, but the risk spreads further. Many private companies host systems for government clients or connect to them. If you run part of a public service, the ministry's checklist applies to you directly.

The tax angle matters for anyone selling online. Scammers often borrow a topic that is already in the news. A fake "digital tax" notice is an easy lure to send to customers or to finance staff. Brands with large customer bases should expect their names to be copied in fake messages.

The AI agent warning is the longer-term story. Attack tools that act on their own can try many weak points quickly and change course without a person steering them. Defenses built around slow, manual review may fall behind.

What to do this week

• Check that your incident response team knows its roles, and that contact details are current.
• Turn on two-step login for every administrator account. Start with your web servers.
• Apply pending software updates on anything that faces the internet.
• Test a restore from backup, so you know recovery works before you need it.
• Warn customers and staff that your company will never ask for passwords or tax payments by email or chat.
• If you run systems on the national data center or Government Cloud, report anything unusual to its official security team.