Darma Henwa
Attack Intelligence
Darma Henwa was compromised in a ransomware attack attributed to spacebears in February 2026. The organization, operating in the Energy sector in ID, was added to the group's data leak site as part of an extortion campaign.
spacebears operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
PT Darma Henwa Tbk - established in 1991, is a company that specializes in mining support and excavation activities. It provides services such as metal fabrication, machinery repair, and equipment leasing. The company also engages in road and railroad construction, as well as building and civil construction. Initially a domestic investment firm, Darma Henwa became a foreign investment company in 1996 and went public in 2007.- Employee personal data- Contracts and client information- Financial reports and audits- Projects and developments- Outlook emails- Internal security reports https://www.ptdh.co.id/