Ransomware in a Multi-Cloud World: Lessons From Indonesia's Data Center Reforms
Only 2% of the data stored at Indonesia's Temporary National Data Center had been backed up when ransomware hit it in June 2024. When the attackers locked the system, there was almost nothing to restore from.
The Brain Cipher attack on Indonesia's PDNS disrupted 282 government services, from immigration checkpoints to student registration. With almost nothing backed up, the government was left negotiating with attackers, since recovery wasn't otherwise possible. It's since become the reference case behind Indonesia's push toward more resilient national data infrastructure.
That lesson applies well beyond government systems. Any business running workloads across multiple cloud providers in Indonesia faces the same underlying risk, and the same fix. Maintaining rigorous cloud security is no longer just an IT goal—it is a core business requirement.
This article covers what happened, what's changing in Indonesia's cloud landscape as a result, and the specific defences, immutable backups and cross-region failover that would have made the difference.
What Multi-Cloud Ransomware Risk Actually Means
Multi-cloud means running infrastructure across more than one cloud provider, often to avoid dependence on a single vendor or to meet data residency requirements. It's increasingly common in Indonesia as businesses split workloads between local and international providers.
The risk is that each additional cloud environment is another place ransomware can spread, and another set of backup and access controls that need to be consistently strong. Managing multi cloud security effectively requires complete visibility across all environments. A single weak link—one cloud environment with connected, unprotected backups—can undo the ransomware protection built everywhere else.
Lessons From Indonesia's National Data Center Attack
The PDNS incident is worth examining closely, because the failure wasn't really about the ransomware itself. It was about what happened after.
Attackers demanded $8 million and the government refused to pay. Officials later confirmed that only 2% of the affected data had backups, according to Stratsea's analysis. Weeks later, only 86 of the 282 disrupted services had been restored, and only because the attackers eventually released a decryption key for free.
That is not a recovery plan. That is luck. A properly backed-up environment doesn't depend on an attacker's goodwill to come back online.
Indonesia's Shift Toward Sovereign, Resilient Cloud Infrastructure
The response to PDNS has directly shaped Indonesia's cloud policy since. The government accelerated construction of the National Data Center (PDN) in Cikarang, a permanent, more secure replacement for the temporary PDNS system, explicitly framed around strengthening data sovereignty after the attack.
For businesses, the direction of travel is clear even outside government systems. Data residency, backup discipline, and business continuity planning are no longer treated as optional hygiene. They are increasingly the baseline expectation for any organisation handling data tied to Indonesian citizens or public services. Adopting robust cloud security practices is central to meeting these regulatory and operational expectations.
The 3-2-1-1-0 Rule for Ransomware-Resistant Backups
The classic 3-2-1 backup rule, three copies of your data, on two types of storage, with one copy offsite, was built for hardware failure and natural disasters. It wasn't built for ransomware, which actively hunts for and destroys backups before encrypting production data.
That's why the standard has evolved to 3-2-1-1-0: the extra "1" requires at least one backup copy to be immutable or air-gapped, untouchable even by an attacker with admin credentials. The "0" requires zero unverified backups, meaning every copy is actually tested for restoration, not just assumed to work.
This isn't a small refinement. Veeam's 2025 Ransomware Trends report found that 89% of organisations had backup repositories specifically targeted by attackers. A backup an attacker can still reach and delete isn't really a backup, it's just another target.
What Immutable Backups Actually Do
Immutable backups can't be modified, encrypted, or deleted for a set retention period, no matter who tries, including ransomware or someone with full administrator access. It's typically enforced through Object Lock or WORM (write once, read many) policies at the storage layer itself, on services like AWS S3 or Azure Blob.
Critical Distinction: Immutability enforced at the storage level holds even if an attacker compromises your backup software or admin account. A lock that only exists at the application level can often be bypassed with the right credentials, which defeats the entire purpose.
Cross-Region Failover for Faster Recovery
Cross-region failover means having a copy of your infrastructure ready in a separate geographic location, so operations can shift there if your primary environment goes down, whether from ransomware, an outage, or a disaster. This is a cornerstone of modern disaster recovery strategies.
For a multi-cloud setup, this means genuine cloud disaster recovery separation, not just another folder in the same cloud account. As one industry analysis puts it, backing up cloud data within the same cloud is duplication, not isolation. If an attacker who compromises your primary environment can also reach the "backup," it was never really separate.
The PDNS case shows exactly why this matters. A functioning failover would have meant switching services to a clean environment within hours, not waiting weeks for an attacker's decryption key.
Hardening Your Multi-Cloud Footprint
Getting this right takes more than a single tool or setting. Elevating your overall cloud security posture across a multi-cloud environment requires several core practices:
- Enable immutability at the storage layer, not just the application layer. This is what keeps a backup safe even if an attacker gets admin access to your backup software.
- Store at least one copy in a genuinely separate cloud or region. Not a second folder in the same account, real geographic and administrative separation.
- Test your restores on a real schedule. Monthly file-level tests, quarterly application-level recovery, and at least one full environment failover test a year. An untested backup is a guess, not a plan.
- Apply consistent access controls across every cloud you use. Attackers look for the weakest environment first. One under-protected cloud account undermines the strength of the rest.
- Document your recovery order. The 3-2-1-1-0 rule tells you how to store data, not how to bring services back online in the right sequence.
Staying Resilient Beyond the Backup Strategy
A strong backup and failover strategy answers the question "can we recover." It doesn't answer "how fast did we notice." Those are different problems, and the second one is often what determines how much damage is done before recovery even starts.
That's where continuous monitoring matters. Watching for the early signs of a ransomware attack—unusual access patterns, unexpected data movement—before encryption even begins, buys time that backups alone can't. Comprehensive cloud security requires both rapid threat detection and resilient recovery mechanisms working in tandem.
Zentara provides that layer across multi-cloud environments, with certified analysts monitoring around the clock and a 15-minute critical response SLA when something needs immediate attention.
Securing multi-cloud architectures against evolving threats demands proactive governance. By implementing immutable backups and verified failover paths, organisations can ensure operational continuity even under severe attack scenarios. Investing in robust cloud security is the single most effective way to safeguard your digital assets and maintain public trust.
Talk to Zentara to see how your current recovery plan would hold up.
Frequently Asked Questions
- What is the difference between the 3-2-1 rule and the 3-2-1-1-0 rule?
The 3-2-1 rule protects against hardware failure and disasters: three copies, two storage types, one offsite. The 3-2-1-1-0 rule adds an immutable or air-gapped copy and mandatory restore testing, specifically to defend against ransomware targeting backups.
- Why do businesses need cross-region failover if they already have backups?
Backups tell you your data can be restored, but restoring from scratch can take days. Cross-region failover lets operations continue from a separate environment almost immediately, which matters when every hour of downtime has a cost.
- Is multi-cloud more secure than a single cloud provider?
Not automatically. Multi-cloud can reduce dependence on one vendor, but it also means more environments to secure consistently. A single weak link in any one cloud can undermine the protection built everywhere else.
- What happened to Indonesia's National Data Center after the ransomware attack?
The 2024 Brain Cipher attack on the Temporary National Data Center (PDNS) exposed a near-total lack of backups. In response, Indonesia accelerated construction of a new, permanent National Data Center (PDN) built around stronger sovereignty and resilience.
