Indonesian Police Identify Suspect in Massive Data Breach Linked to ‘Bjorka’
Table of Contents
Indonesia’s Metro Jaya Police have revealed the identity of a 22-year-old man, identified only by his initials WFT, as the individual behind the X (formerly Twitter) account linked to the notorious online persona “Bjorka.” WFT was apprehended by the Cyber Investigation Directorate for allegedly stealing the personal data of 4.9 million customers from a private Indonesian bank.
The arrest marks a significant development in a case that has raised concerns about cybersecurity vulnerabilities within the nation’s financial sector. A senior official announced WFT’s capture during a press conference at the Jakarta Metropolitan Police on Thursday, October 2, 2025.
Self-Taught Hacker with Limited Formal Education
Despite the sophistication of the data breach, authorities emphasized that WFT is not a formally trained information technology (IT) expert. “Only people who do not graduate from vocational high school,” stated a deputy director of the Metro Jaya Police Siber Detective unit. “However, everyday self-taught he always studies IT.”
The suspect reportedly acquired his skills through independent study and engagement with online communities. “So, he studied everything it was only from IT and through social media communities,” the official added. This highlights a growing trend of individuals leveraging readily available online resources to engage in cybercrime.
Lone Operator with a History in the Dark Web
Investigators believe WFT acted alone, operating from his home without external assistance. According to one investigator, WFT spent the majority of his time in front of a computer, having immersed himself in the Dark Web community and forums as early as 2020.
“From there slowly he began to learn how to make money in the world of dark web, in the computer world,” the investigator explained. WFT allegedly sold the stolen data on the Dark Web for an estimated value of tens of millions of rupiah, the exact amount dependent on negotiations with buyers.
Motivated by Financial Need
The proceeds from these illicit sales were reportedly used to support WFT’s family. Authorities discovered that he is an orphan and the sole provider for his relatives. “From the results of the tracing, he uses for personal needs. Because it turns out he is an orphan. He supports all families. He is an only child, but he supports the family,” a police spokesperson revealed.
Uncertainty Remains Regarding ‘Bjorka’ Identity
Despite identifying WFT as the operator of the X account associated with “Bjorka,” authorities remain cautious about definitively linking him to the broader online persona. A senior official acknowledged the fluid nature of identity in the cyber world, stating, “Maybe, the answer I can answer, maybe. Is Bjorka 2020? Maybe. Is he the Opposite 6890 who was sought? Maybe.”
The official further explained that “in the cyber world there is a term everybody can be anybody,” underscoring the challenges of attributing online activity to specific individuals. Police are continuing to analyze digital evidence and data trails to establish a more conclusive connection. A visual representation of the Dark Web forums frequented by WFT would be beneficial here.
“We need deeper related to the evidence we found, both the data, the digital trail, so that we can formulate it,” the official stated. “I have not been able to answer 90 percent, but if you ask now, I can answer, maybe.” The investigation is ongoing, and authorities are committed to uncovering the full extent of WFT’s activities and any potential connections to other cybercriminal operations.
