Jakarta. Indonesian Police announced on Tuesday the arrest of five suspects accused of hacking into the email system of a Singapore-based real estate developer and orchestrating fraudulent transactions, resulting in the theft of at least Rp 32 billion ($2 million).

According to Brigadier General Himawan Bayu Aji, director of the Cybercrime Division, the syndicate compromised the email system of Kingsford Huray Development Ltd. in Singapore and established a fictitious company in Indonesia to manipulate communication and transactions.

The investigation, conducted in collaboration with Interpol’s National Central Bureau (NCB) in Singapore, led to the arrests of five suspects on April 26, including four men and one woman, with two of the individuals being Nigerian nationals.

"The syndicate infiltrated the company’s email system to acquire data and critical information regarding business transactions. Subsequently, they established an Indonesian company named PT Huttons Asia Internasional to engage with Kingsford Huray Development," Himawan said during a press conference at the National Police headquarters in Jakarta.

Several suspects assumed roles as "directors" within the fabricated company.

On June 20 last year, Kingsford Huray Development transferred funds to an Indonesian bank account under the name Huttons Asia Internasional, Himawan said.

The syndicate impersonated the identities of Kingsford’s clients by manipulating email addresses and headers with imperceptible characters.

The suspects are identified by their initials. The ringleader, a Nigerian citizen identified as CO, was aided by his Indonesian wife, DM. Notably, DM has a history of involvement in email phishing attacks and has previously served two prison sentences between 2018 and 2020.

Investigations reveal that CO instructed his wife and a Nigerian accomplice identified as EJA to recruit two locals tasked with establishing a fake company, serving as directors, and opening a business bank account. The recruited individuals, YC (39) and I (49), were promised a share of 5 percent and 10 percent, respectively, of the embezzled funds.

Himawan said authorities are seeking another Nigerian citizen, identified as S, who allegedly hacked into Kingsford Huray Development’s email system and initiated fraudulent communications.

All suspects face charges under the Electronic Information and Transaction Law and the Anti-Money Laundering Law, with potential sentences of up to 20 years' imprisonment.

Police seized Rp 32 billion in banknotes, four passports, 12 cellphones, a laptop, five bank books, and 20 ATM cards during the operation.