Perlindungan Data Pribadi dalam Kasus Ransomware: Apa Kata Hukum?

Ransomware attacks are an increasingly complex and costly global threat. International reports show a 300% increase in the frequency of ransomware attacks in the last five years (for example, data from IBM Security or Kaspersky). This threat not only blocks data access through encryption, but also jeopardizes privacy. This research will also examine the criminal law aspects associated with ransomware attacks, including the possible prosecution of the perpetrators of the attacks and the legal liability for victimized organizations. The theoretical study in the research titled "Personal Data Protection in Ransomware Cases: What Does the Law Say?" covers the theory of legal protection of personal data. The research method uses normative legal research that examines applicable regulations, namely the Criminal Code, ITE Law, PDP Law. This research refers to the case of a ransomware attack that hit Bank Syariah Indonesia (BSI), where the Lock Bit hacker group managed to steal the personal data of more than 15 million customers. This attack resulted in significant operational disruption to the bank's services. Ransomware is categorized as an act of extortion in accordance with Article 368 of the Criminal Code and Article 27 paragraph (4) of the ITE Law. The ITE Law and the Criminal Code are not considered to specifically regulate ransomware, although the articles (such as extortion and hacking) can be used to ensnare the perpetrators Collaboration between the government, the private sector, and the cybersecurity community is needed to build an early detection system for ransomware threats.