Data Breaches in Government Digital Public Services: A Systematic Mapping of Research and Governance Challenges (2015–2025)

Indah Purwaningsih; Dian Eka Rahmawati

doi:10.59261/bustechno.v7i5.849

Authors

Indah Purwaningsih Universitas Muhammdiyah Yogyakarta
Dian Eka Rahmawati Universitas Muhammdiyah Yogyakarta

DOI:

https://doi.org/10.59261/bustechno.v7i5.849

Keywords:

Bibliometric and Scientometric Analysis, Data Breaches, Digital Public Services, Indonesia, Public Sector Data Governance

Abstract

Background: The rapid digital transformation of public services has increased the collection and use of citizens’ personal data, intensifying concerns about data breaches in government-operated systems. However, existing research remains fragmented, with technical cybersecurity perspectives receiving greater attention than governance and public administration perspectives.

Objective: This study aims to systematically map global research on data breaches in digital public services from 2015 to 2025 and identify theoretical and governance gaps relevant to the Indonesian context.

Methods: A systematic literature review guided by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines was combined with bibliometric and scientometric analyses of publications indexed in Scopus. Descriptive bibliometric analysis and author keyword co-occurrence mapping using VOSviewer were conducted on 1,169 open-access documents, while 62 articles meeting the final eligibility criteria were examined through qualitative synthesis.

Results: The findings reveal an increase in research output and six thematic clusters. Cybersecurity and data security had the highest keyword occurrence (235), whereas privacy, ethics, and data protection exhibited the greatest total link strength (457). Governance, institutional accountability, organizational capacity, and public trust remain comparatively less integrated into technical cybersecurity research.

Conclusion: This study reconceptualizes data breaches in digital public services as sociotechnical governance challenges involving technological vulnerabilities, institutional capacity, regulatory arrangements, and public trust. The findings provide a conceptual foundation for strengthening public-sector data governance in Indonesia while highlighting the need for empirical validation and further comparative research.

References

Abdulkareem, A. K., Abdulkareem, Z. J., Ishola, A. A., & Akindele, I. T. (2022). Does e-government impact e-participation? The influence of trust in e-government. International Review of Public Administration, 27(2), 91–110. https://doi.org/10.1080/12294659.2022.2071540

Amin, M. M., Sutrisman, A., Stiawan, D., Alzahrani, M. Y., & Budiarto, R. (2020). Interoperability framework for integrated e-health services. Bulletin of Electrical Engineering and Informatics, 9(1), 354–361. https://doi.org/10.11591/eei.v9i1.1825

Anggara, S. M., Hariyanto, A., Arman, A. A., & Kurniawan, N. B. (2024). The Development of Digital Service Transformation Framework for the Public Sector. IEEE Access, 12, 146160–146189. https://doi.org/10.1109/ACCESS.2024.3406571

Apostolos, K. (2021). Electronic health records and personal data protection: The legal and sociological approach. Archives of Hellenic Medicine, 38(3), 394–400.

Aria, M., & Cuccurullo, C. (2017). bibliometrix: An R-tool for comprehensive science mapping analysis. Journal of Informetrics, 11(4), 959–975. https://doi.org/10.1016/j.joi.2017.08.007

Attidhira, S. W., & Permana, Y. S. (2022). Review of Personal Data Protection Legal Regulations in Indonesia. Awang Long Law Review, 5(1), 280–294.

Bannister, F., & Connolly, R. (2015). The great theory hunt: Does e-government really have a problem? Government Information Quarterly, 32(1), 112–121. https://doi.org/10.1016/j.giq.2014.10.003

Bender, E. M., Gebru, T., McMillan-Major, A., & Shmitchell, S. (2021). On the Dangers of Stochastic Parrots. Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency, 610–623. https://doi.org/10.1145/3442188.3445922

Bucher, T. (2018). If...Then. Oxford University PressNew York. https://doi.org/10.1093/oso/9780190493028.001.0001

Digay, D., Bochkova, S., Nurbek, D., Khanov, T., Kolganov, S., & Mussekenova, A. (2025). Finding A Balance Between Personal Data Protection And Public Safety In The Age Of Digitalization: International Approaches And Their Adaptation. Relacoes Internacionais No Mundo Atual, 4(50), 124–142. https://doi.org/10.21902/Revrima.v4i50.7787

Donthu, N., Kumar, S., Mukherjee, D., Pandey, N., & Lim, W. M. (2021). How to conduct a bibliometric analysis: An overview and guidelines. Journal of Business Research, 133, 285–296. https://doi.org/10.1016/j.jbusres.2021.04.070

Farwell, J. P., & Rohozinski, R. (2011). Stuxnet and the Future of Cyber War. Survival, 53(1), 23–40. https://doi.org/10.1080/00396338.2011.555586

Floridi, L., Cowls, J., Beltrametti, M., Chatila, R., Chazerand, P., Dignum, V., Lütge, C., Madelin, R., Pagallo, U., Rossi, F., Schafer, B., Valcke, P., & Vayena, E. (2018). AI4People—An Ethical Framework for a Good AI Society: Opportunities, Risks, Principles, and Recommendations. Minds and Machines, 28(4), 689–707. https://doi.org/10.1007/s11023-018-9482-5

Fouracres, A. J. (2023). Handling a data breach out of your control BT - Ethical Case Studies for Coach Development and Practice: A Coach’s Companion (pp. 150–153). Taylor and Francis. https://doi.org/10.4324/b23351-38

Garbaccio, G. L., & Kischelewski, F. L. N. (2024). Governance and best practices at LGPD trough compliance, risk management and accountability. Revista Brasileira de Estudos Politicos, 128, 155–195. https://doi.org/10.9732/2024.V128.894

Gillespie, T. (2019). Custodians of the Internet. Yale University Press. https://doi.org/10.12987/9780300235029

Goggin, G., Vromen, A., Weatherall, K., Martin, F., & Sunman, L. (2019). Data and digital rights: Recent australian developments. Internet Policy Review, 8(1). https://doi.org/10.14763/2019.1.1390

Grimmelikhuijsen, S., Porumbescu, G., Hong, B., & Im, T. (2013). The Effect of Transparency on Trust in Government: A Cross-National Comparative Experiment. Public Administration Review, 73(4), 575–586. https://doi.org/10.1111/puar.12047

Heryawan, L., Mori, Y., Yamamoto, G., Kume, N., Lazuardi, L., Fuad, A., & Kuroda, T. (2025). Fast Healthcare Interoperability Resources (FHIR)–Based Interoperability Design in Indonesia: Content Analysis of Developer Hub’s Social Networking Service. JMIR Formative Research, 9. https://doi.org/10.2196/51270

Ismagilova, E., Hughes, L., Rana, N. P., & Dwivedi, Y. K. (2022). Security, privacy and risks within smart cities: Literature review and development of a smart city interaction framework. Information Systems Frontiers, 24(2), 393–414. https://doi.org/10.1007/s10796-020-10044-1

Janssen, M., & Estevez, E. (2013). Lean government and platform-based governance—Doing more with less. Government Information Quarterly, 30, S1–S8. https://doi.org/10.1016/j.giq.2012.11.003

Jenson, D. (2008). Enterprise data management: Governing for data security. DB2 Magazine, 13(1).

Jones, H. S., Towse, J. N., Race, N., & Harrison, T. (2019). Email fraud: The search for psychological predictors of susceptibility. PLOS ONE, 14(1), e0209684. https://doi.org/10.1371/journal.pone.0209684

Katz, J., & Lindell, Y. (2025). Introduction to Modern Cryptography. Chapman and Hall/CRC. https://doi.org/10.1201/9781003398134

Kayyali, M. (2025). Digital transformation in public sector management: An overview BT - Enhancing Public Sector Accountability and Services Through Digital Innovation (pp. 289–324). IGI Global. https://doi.org/10.4018/979-8-3693-9251-5.ch009

Kietzmann, J. H., Hermkens, K., McCarthy, I. P., & Silvestre, B. S. (2011). Social media? Get serious! Understanding the functional building blocks of social media. Business Horizons, 54(3), 241–251. https://doi.org/10.1016/j.bushor.2011.01.005

Kitchenham, B., & Charters, S. (2007). Guidelines for performing Systematic Literature Reviews in Software Engineering (Number 2).

Klarin, A. (2024). How to conduct a bibliometric content analysis: Guidelines and contributions of content co‐occurrence or co‐word literature reviews. International Journal of Consumer Studies, 48(2), e13031.

Kumar, S., & Singh, V. (2021). Information hiding techniques for cryptography and steganography BT - Advances in Intelligent Systems and Computing (Vol. 1257, pp. 511–527). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-981-15-7907-3_39

Lallie, H. S., Thompson, A., Titis, E., & Stephens, P. (2025). Analysing cyber attacks and cyber security vulnerabilities in the university sector. Computers, 14(2), 49.

LeCun, Y., Bengio, Y., & Hinton, G. (2015). Deep learning. Nature, 521(7553), 436–444. https://doi.org/10.1038/nature14539

Liu, B., Zhou, C. J., Ma, H. W., & Gong, B. (2023). Mapping the youth soccer: A bibliometrix analysis using R-tool. In Digital Health (Vol. 9). https://doi.org/10.1177/20552076231183550

Lodge, M., & Wegrich, K. (2014). The Problem-Solving Capacity of the Modern State: Governance Challenges and Administrative Capacities. Oxford University Press.

Malatji, M., Marnewick, A. L., & von Solms, S. (2021). Cybersecurity policy and the legislative context of the water and wastewater sector in South Africa. Sustainability (Switzerland), 13(1), 1–33. https://doi.org/10.3390/su13010291

Malatras, A., Sánchez, I., Beslay, L., Coisel, I., Vakalis, I., D’Acquisto, G., Sanchez, M. G., Grall, M., Hansen, M., & Zorkadis, V. (2017). Pan-European personal data breaches: Mapping of current practices and recommendations to facilitate cooperation among Data Protection Authorities. Computer Law and Security Review, 33(4), 458–469. https://doi.org/10.1016/j.clsr.2017.03.013

Masinde, J., Mugambi, F., & Muthee, D. W. (2025). Big data and personal information privacy in developing countries: Insights from Kenya. Frontiers in Big Data, 8, 1532362. https://doi.org/10.3389/fdata.2025.1532362

Mazzucato, M., & Kattel, R. (2026). Market-Shaping States: A new theory of public sector capacities and capabilities.

McAllister, J. T., Lennertz, L., & Atencio Mojica, Z. (2022). Mapping a discipline: a guide to using VOSviewer for bibliometric and visual analysis. Science & Technology Libraries, 41(3), 319–348.

Moher, D., Liberati, A., Tetzlaff, J., & Altman, D. (2009). Preferred reporting items for systematic reviews and meta-analyses: the PRISMA statement. Open Medicine, 3, e123-30. https://doi.org/10.1016/j.jclinepi.2009.06.005

Moutamir, H., & El Qour, T. (2025). Digital Transformation Of Public Services Systematic Review Of Key Success Factors. Journal of Theoretical and Applied Information Technology, 103(15), 5895–5912.

Ogutu, H., El Archi, Y., & Dávid, L. D. (2023). Current trends in sustainable organization management: A bibliometric analysis. Oeconomia Copernicana, 14(1), 11–45.

Oroni, C. Z., & Fu, F. (2025). Evaluating the influence of cybersecurity policies and cybersecurity behavior on institutional security performance in remote learning: the moderating role of technological readiness. Sustainable Futures, 10. https://doi.org/10.1016/j.sftr.2025.101554

Page, M. J., McKenzie, J. E., Bossuyt, P. M., Boutron, I., Hoffmann, T. C., Mulrow, C. D., Shamseer, L., Tetzlaff, J. M., Akl, E. A., & Brennan, S. E. (2022). The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. Revista Panamericana de Salud Publica, 46, e112.

Pavlou. (2003). Consumer Acceptance of Electronic Commerce: Integrating Trust and Risk with the Technology Acceptance Model. International Journal of Electronic Commerce, 7(3), 101–134. https://doi.org/10.1080/10864415.2003.11044275

Putra, A. A., Pambudi, R., & Sulistiani, H. (2025). The ethical principles and regulatory frameworks that shape the global landscape of artificial intelligence (AI), situating the analysis within the context of leading international efforts to study and govern AI ethics. Proceeding of International Conference on Islamic Education (ICIED), 10(1), 53–59.

Rahman, F. (2025). Safeguarding Personal Data In The Public Sector: Unveiling The Impact Of The New Personal Data Protection Act In Indonesia. UUM Journal of Legal Studies, 16(1), 1–18. https://doi.org/10.32890/uumjls2025.16.1.1

Romanosky, S. (2016). Examining the costs and causes of cyber incidents. Journal of Cybersecurity, tyw001. https://doi.org/10.1093/cybsec/tyw001

Saydi, F., Mousakhani, M., Tootian Esfahani, S., & Tayaran, S. (2025). Designing and validating the lean governance model in government governance. Public Management Researches, 18(69), 351–385.

Shaikh, F. A., & Siponen, M. (2023). Information security risk assessments following cybersecurity breaches: The mediating role of top management attention to cybersecurity. Computers & Security, 124, 102974. https://doi.org/10.1016/j.cose.2022.102974

Shao, Y., & Shi, X. (2023). Bibliometric analysis and visualization of research progress in the diabetic nephropathy field from 2001 to 2021. Oxidative Medicine and Cellular Longevity, 2023(1), 4555609.

Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017). Membership Inference Attacks Against Machine Learning Models. 2017 IEEE Symposium on Security and Privacy (SP), 3–18. https://doi.org/10.1109/SP.2017.41

Sleem, A. (2022). A Comprehensive Study of Cybersecurity Threats and Countermeasures: Strategies for Mitigating Risks in the Digital Age. Journal of Cybersecurity and Information Management, 10(2), 35–46. https://doi.org/10.54216/JCIM.100204

Sonia Dewi, P. P., Lubis, M., & Abdurrahman, L. (2024). Aligning Healthcare Strategies Through Digital Information and Technology: Challenges and Solution BT - 2024 12th International Conference on Cyber and IT Service Management (CITSM). https://doi.org/10.1109/CITSM64103.2024.10775893

Syifa, S. N., Abdillah, M. T., & Fadil, S. J. (2025). The Legal Responsibility of the General Elections Commission in the 2024 Election Data Leak: Integration of Personal Data Protection Laws and the Principle of Sadd al-Dharī‘at. Justicia Islamica, 22(1), 185–210. https://doi.org/10.21154/justicia.v22i1.10390

Tai, Y. C. (2026). Introducing the trust in government (TrustGov) dataset: A new resource for cross-national time-series trust research. Research & Politics, 13(1), 20531680261432468.

Tikkinen-Piri, C., Rohunen, A., & Markkula, J. (2018). EU General Data Protection Regulation: Changes and implications for personal data collecting companies. Computer Law and Security Review, 34(1), 134–153. https://doi.org/10.1016/j.clsr.2017.05.015

Tripathi, A., & Behl, T. (2020). Protecting The Health Data Of Consumers: Need For An Iron-Clad Law In India. International Journal on Consumer Law and Practice, 8, 105–117.

van den Hoven, J. (2017). Ethics for the Digital Age: Where Are the Moral Specs? BT - Ethics and Law of Intellectual Property (pp. 65–76). https://doi.org/10.1007/978-3-319-55735-9_6

van Eck, N. J., & Waltman, L. (2010). Software survey: VOSviewer, a computer program for bibliometric mapping. Scientometrics, 84(2), 523–538. https://doi.org/10.1007/s11192-009-0146-3

van Eck, N. J., & Waltman, L. (2014). Visualizing Bibliometric Networks BT - Measuring Scholarly Impact: Methods and Practice (Y. Ding, R. Rousseau, & D. Wolfram, Eds.; pp. 285–320). Springer International Publishing. https://doi.org/10.1007/978-3-319-10377-8_13

van Loon, A., & Toshkov, D. (2015). Adopting open source software in public administration: The importance of boundary spanners and political commitment. Government Information Quarterly, 32(2), 207–215. https://doi.org/10.1016/j.giq.2015.01.004

Vatamanu, A. F., & Tofan, M. (2025). Integrating artificial intelligence into public administration: Challenges and vulnerabilities. Administrative Sciences, 15(4), 149.

Verkijika, S. F. (2018). Understanding smartphone security behaviors: An extension of the protection motivation theory with anticipated regret. Computers & Security, 77, 860–870. https://doi.org/10.1016/j.cose.2018.03.008

Wirtz, B., & Müller, W. (2018). An integrated artificial intelligence framework for public management. Public Management Review, 21, 1–25. https://doi.org/10.1080/14719037.2018.1549268

Wong, Y. Q. (2017). Data privacy law in Singapore: The Personal Data Protection Act 2012. International Data Privacy Law, 7(4), 287–302. https://doi.org/10.1093/idpl/ipx016

Zakiuddin, N. F., & Anggara, S. M. (2024). Developing Digital Service Transformation Maturity Model in Public Sector. IEEE Access, 12, 174491–174506. https://doi.org/10.1109/ACCESS.2024.3468341

Zupic, I., & Čater, T. (2015). Bibliometric methods in management and organization. Organizational Research Methods, 18, 429–472. https://doi.org/10.1177/1094428114562629