According to data from the Southeast Asia Freedom of Expression Network (SAFEnet), there were at least 299 cases of digital attacks in Indonesia throughout the third quarter or July-September 2025.
A total of 213 incidents were identified from complaints, 35 incidents from monitoring results, and 51 incidents from reports by the Advocacy Team for Democracy (TAUD).
These digital attacks include threats, hacking, account suspension, unauthorized disclosure of personal information (doxing), extortion, and personal data theft.
SAFEnet stated that Q3 2025 marked the period with the highest number of digital attack incidents since the beginning of the year.
"This number increased by 130 incidents compared to the previous quarter, and surged by 219 incidents compared to the same period in 2024," SAFEnet said in its report.
According to SAFEnet, the surge in cases was driven by politically motivated attacks targeting citizens, students, and activists involved in protests during August-September 2025.
"The most concerning type of attack is the arbitrary physical seizure of devices and data extraction by authorities," they said.
During this period, digital attacks most frequently occurred on two Meta platforms, namely Instagram and WhatsApp.
Below is the number of digital attack incidents in Indonesia based on platform in Q3 2025, according to SAFEnet data:
- Instagram: 85 incidents
- WhatsApp: 80 incidents
- Devices: 40 incidents
- Websites: 19 incidents
- Facebook: 16 incidents
- TikTok: 16 incidents
- Mobile phone numbers: 14 incidents
- X: 8 incidents
- Email: 7 incidents
- Telegram: 4 incidents
- Threads: 3 incidents
- YouTube: 2 incidents
- LinkedIn: 1 incident
- Others: 4 incidents
"Overall, digital attacks most frequently occurred in private communication spaces and social media with large user bases, especially within the Meta ecosystem," SAFEnet stated.
"This pattern indicates that social media is now not only a space for public expression but also the most vulnerable battleground for digital threats, such as hacking, intimidation, doxing, and the dissemination of personal data," it added.