If you have opened the news in Indonesia this month, you have seen the headlines: leaked databases, hackers taunting officials on Twitter, ministries scrambling to respond. Several business owners have asked me the same question this week: "Are we next?"
Here is the honest answer. The cybersecurity threats for SME owners look nothing like the headlines. Nobody is deploying nation-state exploits against your 12-person distribution business. The attacks that actually hit small and medium businesses in Indonesia are boring, cheap, and devastatingly effective: phishing emails, reused passwords, and hijacked WhatsApp accounts.
The good news is that boring attacks have boring defenses, and most of them cost almost nothing. Let me walk you through what is actually happening and what to do about it.
The Threats That Actually Hit SMEs
After fifteen years of building and maintaining systems for businesses of every size, I can count on one hand the sophisticated attacks I have seen against SMEs. The rest fall into a few predictable buckets.
Phishing. Someone in your team gets an email that looks like it came from your bank, from DJP, or from a supplier. It asks them to log in, verify an invoice, or download an attachment. One click and their credentials are gone, or malware is on their laptop. This is by far the most common entry point, and it works because it targets people, not systems.
Credential stuffing. When a big platform leaks its user database, and Indonesian platforms have leaked plenty, attackers take those email and password pairs and try them everywhere else. If your finance staff uses the same password for a leaked marketplace account and your accounting software, the attacker walks in through the front door. No hacking required.
Account takeover of business channels. WhatsApp Business accounts, Instagram shops, Tokopedia seller accounts. Attackers take them over, then message your customers asking for transfers to a "new account number." Your customers lose money, and you lose trust that took years to build.
Business email compromise. An attacker who has been reading a compromised inbox waits for a large invoice, then sends a follow-up email changing the bank account. I have seen an SME in Jakarta nearly transfer Rp340 million to a fraudster this way. The finance officer caught it only because she called the supplier to confirm.
Notice what is missing from this list: zero-day exploits, ransomware gangs targeting you specifically, movie-style hacking. Those exist, but for a typical SME they are not where the risk lives.
Why the Headline Breaches Still Matter to You
You might think the recent government and telco leaks are someone else's problem. They are not, for one specific reason: those leaks feed the credential stuffing attacks I described above.
Every leaked database of Indonesian emails and passwords becomes ammunition. If anyone in your company has ever registered on a leaked platform with their work email and a password they also use at work, your business is exposed today, regardless of how good your own systems are.
This is why the single most important question is not "is our server secure?" but "how many of our passwords are reused?"
The 90 Percent Solution: Three Moves
You do not need a security consultant on retainer. You need three things done properly, and you can finish all of them this month.
Turn on two-factor authentication everywhere. Email first, then banking, then your business social accounts, then your accounting and admin systems. With 2FA on, a stolen password alone is not enough to get in. This one setting neutralizes most credential stuffing and a large share of phishing. It is free. Start with Google Workspace or whatever email you use, because email is the master key to everything else.
Adopt a password manager for the team. Bitwarden has a free tier and an affordable team plan, roughly Rp50,000 per user per month at current pricing. It generates a unique password for every service, which means one leaked account no longer compromises the rest. The transition takes an afternoon per person.
Establish one verification rule for money. Any change to a bank account number, any unusual transfer request, gets confirmed through a second channel. Email asks for a transfer? Call the person. WhatsApp asks to change an account? Call the office number you already have. This single habit kills business email compromise and most social engineering.
If you do only these three, you have eliminated the attack paths behind the vast majority of real SME incidents I have seen.
The Next Layer, Once the Basics Are Done
Once 2FA, unique passwords, and the verification rule are in place, spend your remaining energy here:
- Updates. Keep operating systems, WordPress installs, and plugins current. Most malware exploits vulnerabilities that were patched months earlier.
- Access review. List who has access to what, and remove accounts of people who left. Ex-employee accounts are a quiet, common breach vector.
- Backups. If ransomware or a mistake does hit, a tested backup turns a catastrophe into an inconvenience. I wrote a full guide on this in Backups and Disaster Recovery: Your Boring Insurance Policy.
- A 30-minute team briefing. Show your staff two or three real phishing examples. People who have seen the trick once are dramatically harder to fool. Repeat it twice a year.
Notice the order. Antivirus subscriptions, firewalls, and penetration tests all have their place, but they come after the basics, not before. I regularly meet businesses paying millions of rupiah per year for security software while their director's email has no 2FA.
What This Costs, Honestly
Let me put numbers on it for a 15-person company:
| Measure | Cost | Time |
|---|---|---|
| 2FA on all critical accounts | Rp0 | 1 afternoon |
| Password manager (team plan) | ~Rp750,000/month | 1 week rollout |
| Money verification rule | Rp0 | 1 memo + 1 meeting |
| Phishing awareness briefing | Rp0 | 30 minutes, twice a year |
Under Rp10 million a year, mostly time. Compare that to the median losses I hear about when things go wrong: tens to hundreds of millions of rupiah, plus customer trust that does not come back with an apology post.
The Takeaway
The breach headlines are real, but the lesson most SME owners draw from them is wrong. You are not a target for elite hackers. You are a target for automated, high-volume, low-effort attacks that succeed because of reused passwords and one distracted click.
So redirect the fear productively. This week: enable 2FA on your email and bank. This month: roll out a password manager and announce the verification rule for any money movement. That is the 90 percent solution, and it costs less than one client dinner.
Security, like most of the technology decisions that matter, works best when it is part of a deliberate plan rather than a panic response. If your business has been making these calls reactively, it may be time to think about a proper technology strategy instead of another one-off fix.