-
KNOK666X claims it leaked an Indonesian education data set with 154,375 records.
-
The post lists a 4.89 MB file, a link to get it, and a sample in JSON.
-
No proof yet shows that a live state system was hacked or that the data is new.
A hacker who uses the name KNOK666X says it has leaked an Indonesian education data set. The claim came from a post on an underground crime forum. The post says the set has 154,375 records. It also lists a file of about 4.89 MB.
In addition, the hacker posted a link to get the file. They also added a JSON sample. The sample seems to hold data about people. But the sample does not prove the source. It also does not show that a state system was hit in a new attack.
KNOK666X has Repeatedly Targeted Indonesia
HackNotice has tracked a number of KNOK666X posts about sites run by state groups. One July report tied the name to a site for civil and birth records in Karangasem. Another July report tied KNOK666X to a Banjarbaru state site. In August, HackNotice also tracked a claim tied to the 2025 Army school intake process.
Thomas Murray has also put KNOK666X on its list of active threat groups in Indonesia. Its June 2026 report counted 15 cases tied to the name. It said most of the cases dealt with data theft or data leaks. Also, its July report named KNOK666X as a key actor in Indonesia. The same report said the school and college sector had the most cases that month, with 39.
That past record makes the new post worth a close look. Still, it does not prove the new data set came from a new attack.
The Ministry Name Needs Some Context
In the post, the attacker claims the data came from the Ministry of Education and Culture of Indonesia. But Indonesia restructured its ministry setup in 2021. The old ministry no longer runs all school and culture work as one body. Primary and high school work now sits with the Ministry of Primary and Secondary Education. The short name is Kemendikdasmen.
Work on colleges and higher study sits with the Ministry of Higher Education, Science, and Technology. The short name is Kemdiktisaintek. Culture now has its own Ministry of Culture. So, the phrase “Ministry of Education and Culture data set” does not tell us which body held the data. It could point to an old state database. It could also point to a firm that works for the state.
The Group Name is Also Unclear
The post credits the leak to “Badan Intelejen Database.” One shouldn’t confuse that title with the name of Indonesia’s real intelligence agency, which is Badan Intelijen Negara (BIN).
We found no sound state source that lists “Badan Intelejen Database” as a state body. The name may be a group name. It may also be a fake name or a tag used to draw more eyes to the post. It is not proof of a link to the state.
What the Alleged Dataset may Contain
The JSON sample seems to show fields that hold data about people. If the data is real, it could put the people in the file at risk. Bad actors could use such data to send fake mail, trick users, or set up fake accounts.
But a sample can come from many places. It may be from an old breach or data that used to be publicly available in the past. A third party may have held the data, rather than a state body.
The 4.89 MB file size also tells us very little. A small file can hold a lot of rows when each row has short text. So, the size of the file does not prove that the data is new, whole, or real. They also need to look for signs that tie the data to one known source.
No Proof of a New State Hack
For now, the claim should stay in the “unconfirmed” box. There is no proof that KNOK666X broke into a live Indonesian education system in a new attack. Also, there are currently no independent sources to validate the 154,375 figure. The past KNOK666X claims make this case worth watching. But past claims cannot prove a new one.
In August 2026, a hacker claimed to have stolen 43GB of data from France’s education system, allegedly exposing student and staff records. While a separate cyberattack was confirmed in July, the larger 346-million-record claim remains unverified.
Researchers need to find out if the rows are real. They also need to check when the data was made and who first held it. They’d then work out if the source was a current ministry, an old state body, or a third party. Until these checks are complete, the 154,375 records remain a claim from KNOK666X.
The case still gives state groups in Indonesia a clear warning. Data held by schools and state bodies can draw the eye of crime groups. Both link and sample data could be useful in verifying or disproving claims. However, these alone can’t reveal where the data is from or when and how the attacker obtained it.
