THREAT WATCH · November 15, 2026 · RANSOMWARE LISTING

PIXELLEAKS appears as a new ransomware listing

Intel128 Threat Watch has recorded a new ransomware listing for PT. Fiber Networks Indonesia (AltosDLP surveillance platform, fiber.net.id). The organization is listed under the domain fiber.net.id. The record carries a date of November 15, 2026.

Key takeaways

• PIXELLEAKS lists PT. Fiber Networks Indonesia (AltosDLP surveillance platform, fiber.net.id) as of November 15, 2026 in its public victim feed.
• A listing is strong signal, not a confirmed breach - disclosure status: no statement recorded.
• The Intel128 record carries no country or sector - treat specifics as unconfirmed.
• Organizations in this position should rotate credentials and review sign-in logs now, not later.

The listing

• Attack group: PIXELLEAKS
• Listed domain: fiber.net.id
• Record date: November 15, 2026

What this means

Ransomware groups publish victim lists to pressure payment and to signal capability. A listing like this one is strong intelligence that the group reached into PT. Fiber Networks Indonesia (AltosDLP surveillance platform, fiber.net.id)'s environment - but until the organization confirms it, the listing remains a claim on an attacker-side feed, not a verified incident.

If the listing is accurate, the exposure window usually starts well before publication: credentials taken during the intrusion may still be valid, and reused passwords are the most common follow-on failure. The honest read is therefore one of urgency, not alarm.

Recommended next steps

• Rotate credentials for every account tied to the listed domain; force MFA re-enrollment.
• Review IdP sign-in logs for unfamiliar locations or service-principal activity around the record date.
• Check whether the same password pattern exists in adjacent systems (VPN, ticketing, mail).
• If you work at or with this organization: confirm incident status internally before responding externally.

The group's own entry reads, verbatim: "PT. Fiber Networks Indonesia (AltosDLP surveillance platform, fiber.net.id)".

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED NOV 15, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.