Corporate Liability and Cyber-Economic Crime in Islamic Banking: Sanctions, Vicarious Liability, and the 2023 BSI Breach under Indonesian Positive Law
Main Article Content
Abstract
This study examines cyber-economic crime through the lens of the 2023 data breach incident involving Bank Syariah Indonesia, reportedly caused by the LockBit 3.0 ransomware group. It analyses the corporate liability of an Islamic bank from the perspective of Indonesian positive law. A bank must safeguard the confidentiality, integrity, and availability of customer data and electronic systems as part of its information-technology risk-management obligations; maintain cybersecurity in accordance with financial-sector regulation; protect electronic information; and promptly report serious disruptions to law-enforcement agencies and the relevant ministries. Using normative legal research, the study proposes a three-layer model of corporate responsibility for data breaches under administrative, civil, and criminal regimes. Administratively, failure to meet cybersecurity duties may attract regulatory sanctions. Civilly, customers may claim compensation for breaches of data confidentiality and security. Criminally, corporate liability may arise where an offense is committed in the corporation’s interest or is connected with culpable failure to prevent it. The framework also engages vicarious liability principles when senior officials fail in their cybersecurity policy responsibilities. Taken together, the administrative, civil, and criminal layers show that a data breach at an Islamic bank may result in significant regulatory sanctions, compensation liability, and criminal consequences, and is not merely a technical problem.
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
References
Al-Irfan, A. A., et al. (2021). Law enforcement and prevention of banking criminal actions in Indonesia. Türk Bilgisayar ve Matematik Eğitimi Dergisi, 12(3), 5733–5744. https://doi.org/10.17762/turcomat.v12i3.2249
Allegrezza, S. (2020). Information exchange between administrative and criminal enforcement: The case of the ECB and national investigative agencies. Eucrim – The European Criminal Law Associations’ Forum, 15(4), 302–309. https://doi.org/10.30709/eucrim-2020-024
Alotaibi, H. A., Alyahya, B. A., & Alazizi, S. R. (2026). Electronic signatures in Saudi Arabia’s contemporary digital era: Examining authenticity and attribution through the lens of Islamic law. MILRev: Metro Islamic Law Review, 5(1), 845–890. https://doi.org/10.32332/milrev.v5i1.13561
Andini, T. W., & Yusuf, H. (2025). Legal analysis of the transformation of economic crimes in the digital era (cybercrime). NOTARIIL: Jurnal Kenotariatan, 10(1), 1–6. https://doi.org/10.22225/jn.10.1.2025.1-6
Andrian, A., & Andrian, A. (2023). Bank responsibility on customer’s data fraud in Indonesia. International Journal of Social Science and Human Research, 6(5), 2841–2846. https://doi.org/10.47191/ijsshr/v6-i5-63
Astuti, N. K. (2025). Corporate criminal liability in digital economic crimes: An analysis of legal developments in Indonesia. Indonesian Journal of Law and Justice, 3(2), Article 9. https://doi.org/10.47134/ijlj.v3i2.5013
Azero, M. A., Abdullah, S. N. A. K., Zakaria, Z., Haris, H., & Yusoff, Y. H. (2024). The nexus of cybercrime and money laundering: A conceptual paper. Accounting and Finance Research, 13(2), 167–176. https://doi.org/10.5430/afr.v13n2p167
Cumming, D. J., Nguyen, M., Pham, A. V., & Samarasinghe, A. (2025). Banking system stability: A global analysis of cybercrime laws [Preprint]. arXiv. https://doi.org/10.48550/arxiv.2512.01237
Cumming, D. J., Nguyen, M., Pham, A. V., & Samarasinghe, A. (2026). Banking system stability: A global analysis of cybercrime laws. Journal of International Business Studies. Advance online publication. https://doi.org/10.1057/s41267-025-00838-3
Dada, S. E. H. K., & Heliany, I. (2026). Corporate liability for cybercrime: A legal analysis of the protection of personal data subjects (Case study of the Pangkalpinang District Court Decision Number 142/Pid.Sus/2024/Pn Pgp). FOCUS, 7(1), 14–20. https://doi.org/10.37010/fcs.v7i1.2165
Darem, A. A., Alhashmi, A. A., Alkhaldi, T. M., Alashjaee, A. M., Alanazi, S. M., & Ebad, S. A. (2023). Cyber threats classifications and countermeasures in banking and financial sector. IEEE Access, 11, 125138–125158. https://doi.org/10.1109/access.2023.3327016
Dawodu, S. O., Omotosho, A., Akindote, O. J., Adegbite, A. O., & Ewuga, S. K. (2023). Cybersecurity risk assessment in banking: Methodologies and best practices. Computer Science & IT Research Journal, 4(3), 220–243. https://doi.org/10.51594/csitrj.v4i3.659
Ekawati, D., Herdiana, D., & Haryanti, A. (2025). Phishing in the banking sector: Between cybercrime and consumer protection. SIGn: Jurnal Hukum, 7(1), 133–151. https://doi.org/10.37276/sjh.v7i1.422
Farrun, R. I., & Purwanto, A. M. D. C. (2024). Prinsip kerahasiaan dan prinsip kehati-hatian dalam perlindungan data nasabah bank syariah. Wajah Hukum, 8(2), 744–753. https://doi.org/10.33087/wjh.v8i2.1542
Faza, G., & Wiyanti, D. (2024). Tanggung jawab Bank Syariah Indonesia (BSI) terhadap nasabah yang diretas data pribadinya berdasarkan Undang-Undang No. 1 Tahun 2024 tentang Informasi dan Transaksi Elektronik jo. Undang-Undang No. 27 Tahun 2022 tentang Perlindungan Data Pribadi. Bandung Conference Series: Law Studies, 4(2), 867–873. https://doi.org/10.29313/bcsls.v4i2.12630
Hargreaves, C., & Prince, D. (2013). Understanding cyber criminals and measuring their future activity (Technical Report). Lancaster University. https://eprints.lancs.ac.uk/id/eprint/65477/
Harrieti, N., Mantili, R., Bunga, D., & Manap, N. A. (2026). Restorative justice in law enforcement of banking crimes: How it’s works? Jambura Law Review, 1(1), 1–29. https://doi.org/10.33756/jlr.v1i1.27715
Husain, N. S. (2025). Peran Otoritas Jasa Keuangan (OJK) dalam mengatasi kejahatan digital studi kasus kebocoran data pada Bank Syariah Indonesia. Ganec Swara, 19(1), 56–63. https://doi.org/10.35327/gara.v19i1.1293
Hutagalung, M. W. R., Siregar, S., Furqan, M., Pulungan, I., & Elce, F. (2025). Cybersecurity behavior as a reflection of Ḥifẓ al-Māl in Islamic banking. El-Qist: Journal of Islamic Economics and Business, 15(2), 127–153. https://doi.org/10.15642/elqist.2025.15.2.127-153
Jain, K., & Gochhait, S. (2024). Risk management approach to financial cybersecurity in Islamic banks: A review. In 2024 International Conference on Emerging Technologies in Computing and Sustainable Information Systems (ICETSIS) (pp. 1168–1172). IEEE. https://doi.org/10.1109/icetsis61505.2024.10459501
Kaya, M. (2021). Self-disclosure or burying the evidence dilemma: A legal review of the data breach rules under the Turkish Personal Data Protection Law. Annales de la Faculté de Droit d’Istanbul, 70, 1–48. https://doi.org/10.26650/annales.2021.70.1305
Keliat, V. U., Siregar, A. P., Zulkifli, S., & Purba, I. H. (2023). Analisis upaya dan peran perlindungan hukum terhadap kasus peretasan data Bank Syariah Indonesia. Jurnal Ilmu Hukum Prima, 6(2), 182–190. https://doi.org/10.34012/jihp.v6i2.4251
Khadam, N., Anjum, N., Alam, A., Mirza, Q. K. A., Assam, M., Ismail, E. A. A., & Abonazel, M. R. (2023). How to punish cyber criminals: A study to investigate the target and consequence based punishments for malware attacks in UK, USA, China, Ethiopia & Pakistan. Heliyon, 9(12), Article e22823. https://doi.org/10.1016/j.heliyon.2023.e22823
Kholiq, A., Shodikin, A., & Rahim, F. (2025). The model of Islamic criminal law enforcement against cyber crime. Jurnal Legisci, 3(2), 101–120. https://doi.org/10.62885/legisci.v3i2.940
Komaruddin, K., Utama, A. S., Sudarmanto, E., & Sugiono, S. (2023). Islamic perspectives on cybersecurity and data privacy: Legal and ethical implications. West Science Law and Human Rights, 1(4), 166–172. https://doi.org/10.58812/wslhr.v1i04.323
Maharani, D. P., Kusumadara, A., Widhiyanti, H. N., & Dewantara, R. (2025). Administrative legal liability for data breaches: Securing the right to compensation in Indonesia and the EU. Law, Human, Environment, 16(3), 173–190. https://doi.org/10.31548/law/3.2025.173
Marzuki, P. M. (2007). Penelitian hukum. Prenada Media Group.
Muhaimin. (2020). Metode penelitian hukum. Mataram University Press.
Muladi. (2020, February 29). Watak khas tindak pidana ekonomi. Kompas.id. https://www.kompas.id/baca/opini/2020/02/29/watak-khas-tindak-pidana-ekonomi
Mulyohadi, A. (2024). Integrating Electronic Information and Transaction Law (UU ITE) and Islamic criminal law: Addressing malware-based data theft. Al-Ahkam: Jurnal Ilmu Syari’ah dan Hukum, 9(2), 154–170. https://doi.org/10.22515/alahkam.v9i2.10269
Ombu, A. (2023). Role of digital forensics in combating financial crimes in the computer era. Journal of Forensic Accounting Profession, 3(1), 57–75. https://doi.org/10.2478/jfap-2023-0003
Palit, S. M. L., & Purba, T. L. D. (2025). Digital banks in the Indonesian banking system: A post-POJK No. 12/POJK.03/2021 study. Awang Long Law Review, 8(1), 457–465. https://doi.org/10.56301/awl.v8i1.1804
Ponadi, P., Lisdiyono, E., Supeno, B. J., & Noor, A. (2024). Revitalizing criminal liability models in banking regulations: Towards achieving justice. International Journal of Religion, 5(4), 395–401. https://doi.org/10.61707/txqm0x72
Porcedda, M. G. (2018). Patching the patchwork: Appraising the EU regulatory framework on cyber security breaches. Computer Law & Security Review, 34(5), 1077–1098. https://doi.org/10.1016/j.clsr.2018.04.009
Pratama, M. R., & Suryokencono, P. (2025). Tanggung jawab Bank BSI atas kebocoran data nasabah. Indonesian Journal of Law and Justice, 3(1), Article 17. https://doi.org/10.47134/ijlj.v3i1.4804
Riyadi, G. (2021). Data privacy in the Indonesian personal data protection legislation [Preprint]. Center for Indonesian Policy Studies. https://doi.org/10.35497/341482
Rokhim, A., Lawang, K. A., Zuraida, Z., & Syahrul, F. M. (2025). Islamic legal principles and national reform: A study of the 2023 Indonesian Penal Code. Kanun: Jurnal Ilmu Hukum, 27(1), 133–151. https://doi.org/10.24815/kanun.v27i1.41348
Schmitz-Berndt, S., & Chiara, P. G. (2022). One step ahead: Mapping the Italian and German cybersecurity laws against the proposal for a NIS2 directive. International Cybersecurity Law Review, 3(2), 289–311. https://doi.org/10.1365/s43439-022-00058-7
Sudiro, A. (1996). The scope of economic crime in banking. Era Hukum, 9(3), 56–70.
Sukardi, B., Fachrurazi, F., & Supriyanto, S. (2019). Sharia Maqashid’s inclusive performance and contribution to the sharia non-bank financial industry in Indonesia. Economica: Jurnal Ekonomi Islam, 10(2), 283–310. https://doi.org/10.21580/economica.2019.10.2.4325
Sulaeman, S., Herianingrum, S., Ryandono, M. N. H., Napitupulu, R. M., Hapsari, M. I., Furqani, H., & Bahari, Z. (2025). Islamic business ethics in the framework of higher ethical objective (Maqasid al-Shariah): A comprehensive analysis and future research directions. International Journal of Ethics and Systems, 1–29. Advance online publication. https://doi.org/10.1108/ijoes-12-2024-0398
Sulaiman, S. A., Emirzon, J., & Hamzah, H. (2023). Development of the default concept against losses due to standard agreements for opening banking accounts. Fiat Justisia: Jurnal Ilmu Hukum, 17(4), 359–374. https://doi.org/10.25041/fiatjustisia.v17no4.3015
Suseno, S., Ramli, A. M., Mayana, R. F., Safiranita, T., & Tiarma, B. A. N. (2025). Cybercrime in the new criminal code in Indonesia. Cogent Social Sciences, 11(1), Article 2439543. https://doi.org/10.1080/23311886.2024.2439543
Szaplonczay, A. (2021). White-collar crime: Contemporary view. Teisė, 120, 140–146. https://doi.org/10.15388/teise.2021.120.10
Teichmann, F. M. J. (2026). Platform governance under NIS2 and the Cyber Resilience Act: Cybersecurity by design as social practice. Information, Communication & Society, 1–14. Advance online publication. https://doi.org/10.1080/1369118x.2025.2609780
Temcharoenkit, S., & Rani, A. A. V. (2025). Strengthening digital citizens against love scams: A case study of Indonesia and Thailand. Jurnal Pendidikan Sosial Indonesia, 3(2), 107–116. https://doi.org/10.62238/jupsi.v3i2.276
Tennant, I., & Oliveira, A. (2024). Applying the right lessons from the negotiation and implementation of the UNTOC and the UNCAC to the implementation of the newly agreed UN ‘cybercrime’ treaty. Journal of Cyber Policy, 9(2), 221–238. https://doi.org/10.1080/23738871.2024.2428655
Tryatmadja, M., Amin, R., & Sulastri, L. (2026). Criminal liability of banks in the crime of falsifying records. Journal of Law and Regulation Governance, 4(2), 62–81. https://doi.org/10.57185/jlarg.v4i2.162
Utami, W., Mulya, V. R., Shima, G. P., Ayyash, Y., Andriyanto, A. R., & Judhokusumo, R. M. A. (2025). Pemanfaatan artificial intelligence dan pelanggaran rahasia bank: Studi kasus kebocoran data nasabah Bank Syariah Indonesia (BSI) ditinjau dari Pasal 40 Undang-Undang Nomor 10 Tahun 1998 tentang Perbankan. Journal of Legal, Political and Humanistic Inquiry, 1(2), 10–17. https://doi.org/10.65310/13m27813
van der Wilt, H. (2017). Mental blockades in the recognition of mens rea in corporations. In V. Mitsilegas, M. Bergström, & T. Konstadinides (Eds.), Research handbook on EU criminal law (pp. 399–409). Edward Elgar Publishing. https://doi.org/10.1017/9781139681025.028
Widayanti, T. F., Rohman, A. D., Haris, A., Djafar, E. M., & Hakim, M. Z. (2025). Enhancing cybersecurity and legal integration: Reforming Indonesia’s cyber law to foster sustainable growth in the digital economy. Diponegoro Law Review, 10(1), 105–119. https://doi.org/10.14710/dilrev.10.1.2025.105-119
Yuspin, W., Wardiono, K., Nurrahman, A., & Budiono, A. (2023). Personal data protection law in digital banking governance in Indonesia. Studia Iuridica Lublinensia, 32(1), 99–130. https://doi.org/10.17951/sil.2023.32.1.99-130
Zulfahmi, Z., Aulia, P. R., Muklis, M., & Pulungan, R. (2025). Perbandingan perspektif hukum pencegahan kejahatan dunia maya dalam hukum positif dan hukum pidana Islam. At-Thawalib: Jurnal Kependidikan Islam, 6(2), 140–155. https://doi.org/10.24952/el-thawalib.v6i2.14928