Indonesia's November 2026 Cyber Alert: 4 Security Moves Every Business Should Make Now

The second week of November 2026 has been a busy one for anyone responsible for IT security in Indonesia. Within just a few days, the banking sector reported a sudden wave of cyberattacks, the government told every public institution to raise its guard, and two of the most widely used enterprise software vendors, Microsoft and SAP, shipped large batches of critical security fixes. None of these stories is only for banks or ministries. Together they paint a clear picture of the risks facing every Indonesian organisation right now, and a short list of actions that pay off quickly.

1. A sudden attack wave on Indonesian banks

According to FortiGuard Labs data reported by The Jakarta Post and The Star on 9 November, more than 1.2 million attacks were recorded against banking, finance and insurance targets in Indonesia within 24 hours, up from around 657,000 over the preceding weekend. The technology sector (about 434,000 attacks) and government (about 163,000) were the next most targeted. The financial services regulator OJK said its technology supervisors had been working with banks since the previous Friday, sent letters with technical measures such as extra scrutiny of significant transactions and pausing anomalous ones for verification, and activated its incident response team together with Bank Indonesia. Banks were also reminded that regular penetration tests, attack simulations and technology audits are required under digital resilience rules.

What to do: Even if you are not a bank, your suppliers, payment partners and customers may be. Review your own transaction and login anomaly alerts, confirm you have an up-to-date incident response contact list, and remind staff to reach banks and partners only through official channels.

2. Government-wide advisory: DDoS, defacement, DNS hijacking and phishing

On 10 November, the Ministry of Communication and Digital (Kemkomdigi) instructed government institutions and public electronic system operators to strengthen their digital security, following a BSSN security advisory issued through Gov-CSIRT Indonesia on 8 November. Letters went to users of the National Data Center (PDN) and government cloud services, to domain officials at ministries and regional governments, and to all public-sector system operators. The ministry named DDoS attacks, website defacement, vulnerability exploitation, DNS hijacking, phishing and disinformation as the main threats, and noted that the reported threat had not yet been verified. Its recommendations included readying incident response teams, stronger authentication for administrator accounts, software updates, better DDoS protection, working backups and recovery mechanisms, and continuous network monitoring.

What to do: This checklist applies to private companies too. Enforce multi-factor authentication on every admin account (including your domain registrar and DNS provider), check that your website sits behind DDoS protection, and test a real restore from backup rather than assuming it works.

3. Microsoft's November Patch Tuesday includes an exploited Outlook flaw

Microsoft's 10 November security release was very large, with Cybersecurity News counting more than 1,000 newly published vulnerabilities, 63 of them rated Critical. The priority item is an Outlook spoofing vulnerability that Microsoft confirms is already being exploited. If a user opens a specially crafted message file, Outlook can connect to an attacker-controlled location without the usual warning and leak the user's NTLMv2 password hash. It affects Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024. Critical fixes also cover Hyper-V, Exchange Server, SMB Server, TCP/IP, LDAP and Office apps such as Excel and Word.

What to do: Push the Office and Outlook updates to all endpoints first, then patch Hyper-V hosts, Exchange servers and any internet-facing Windows servers. Where possible, restrict outbound SMB/NTLM traffic to the internet, which limits the damage from hash-leaking attacks like this one.

4. SAP patches four maximum-severity flaws

SAP's November Security Patch Day, also on 10 November, delivered 42 new and updated security notes, including nine critical fixes, four of them rated maximum severity, as reported by SecurityWeek. Two of the most serious, nicknamed ICM2SHELL and ProxyGate by researchers at Onapsis, can let an unauthenticated attacker run operating system commands on SAP NetWeaver, Web Dispatcher or SAP Gateway systems. Another flaw in the NetWeaver SAML2 service provider could let attackers impersonate users in certain configurations. No in-the-wild exploitation was reported at the time, but researchers demonstrated a working exploit to SAP.

What to do: If your ERP runs on SAP, schedule the November notes as an emergency change, starting with internet-exposed Web Dispatcher and gateway components, and make sure a tested system backup exists before you patch.

The common thread: fundamentals win

Attack waves come and go, but the organisations that ride them out share the same habits: patches applied within days rather than months, strong authentication on privileged accounts, monitoring that someone actually watches, and backups that have been proven to restore. This week is a good moment to check all four.

How Real Integrasi can help

Real Integrasi Nusantara helps Indonesian businesses put these fundamentals in place, from cybersecurity assessments and Microsoft 365 security hardening to backup and disaster recovery that is tested, not just configured. As a Microsoft, Zoom and AWS partner, our team can review your patching, identity and recovery posture and give you a practical action plan.

Consult for FREE via WhatsApp, or email hello@realintegrasi.com.

Sources: The Star / The Jakarta Post (9 Nov 2026), Suara.com (11 Nov 2026), Cybersecurity News (10 Nov 2026), SecurityWeek (10 Nov 2026).