The Surabaya bombings were a series of terrorist attacks that initially occurred on 13 May 2018 in three churches in Surabaya, the second largest city in Indonesia and the capital of East Java province. The explosions occurred at Immaculate Saint Mary Catholic Church (Gereja Katolik Santa Maria Tak Bercela, SMTB) on Ngagel Madya Street; Indonesia Christian Church (Gereja Kristen Indonesia, GKI) on Diponegoro Street; and Surabaya Central Pentecostal Church (Gereja Pantekosta Pusat Surabaya, GPPS) on Arjuno Street. The first explosion took place at the SMTB Church; the second and third explosions followed within an hour.

The fourth bombing occurred in an apartment complex in Sidoarjo, a regency located south of Surabaya, after the terrorists accidentally set off the bombs inside the room; three were killed and a teenager and two children were injured. The fifth bombing occurred the next day at the Surabaya Police Headquarters (Mapolrestabes Surabaya); two perpetrators detonated their devices while they were being checked by police at the entrance.

As of 1 June 2018, 28 people were killed, including the suicide bombers. Around 50 others were injured; several were in critical condition. The attacks occurred just days after the standoff at Mako Brimob in Depok, in which five police officers were killed. The attacks are the deadliest terror attack in Indonesia since the 2002 Bali bombings.

The bombings were regarded as one of the most sophisticated and complex terror attacks in Indonesia. It was also the first of its kind in Indonesian history in which children as young as nine years old participated.

Background It was estimated in 2017 that hundreds of Indonesians went to Syria or Iraq to fight for ISIL before returning to Indonesia. The returning individuals are placed through a deradicalization program by the National Agency for Combating Terrorism, and are put on a watchlist for the agency and local governments alike. Several terrorist attacks, such as the Thamrin attacks, were orchestrated by the returnees or local extremists who pledged alliance to ISIL.

In 2016, President Joko Widodo requested lawmakers to revise the country's anti-terrorism laws, which were published in 2003 and 2013. He questioned the law's effectiveness, as the government was legally unable to arrest perpetrators of the Thamrin attacks preemptively. The revision encountered resistance, with critics remarking that the law would allow arbitrary arrests. Later on, opposition arose from human rights groups due to the involvement of the Indonesian National Armed Forces in the bill, which would put them in a law enforcement role. Regardless, the bill continued to press on, although it was put on hold in late February 2018 as both the military involvement and the legal definition of terrorism came into debate.

Between 8 May and 10 May, a standoff occurred at the Mobile Brigade Corps' headquarters in Depok, resulting in the deaths of five police officers. While the incident and hostage situation ended with the 155 rioters surrendering, in the aftermath, police shot dead four individuals who were suspected terrorists allegedly travelling "to help the rioting prisoners". Amaq News Agency claimed ISIL was responsible.

Bombings First The first attack occurred on 06:30 WIB (UTC+07:00) in front of the SMTB Church. Eyewitnesses said the attack occurred shortly after the first mass. Survivors said the perpetrators immediately entered the church without taking the parking ticket first. As people gathered in the hall, several witnesses said they saw two people riding a motorcycle were being stopped by a security officer named Aloysius Bayu Rendra Wardhana at the church's entrance. Shortly afterwards, the perpetrators detonated the bomb. The blast immediately killed a child and the security officer.

The first attack was captured on camera. In the first video, the perpetrators immediately entered the church without stopping and then detonated the bomb. The second video showed the bombing from a front door near the entrance. At the time, people were walking out of the church, and several others were entering the church as the first mass had finished. The perpetrators immediately detonated their devices as they were being stopped by security. As the explosion happened, multiple people inside the church began to panic. Several people who lived nearby mistook the explosion as an earthquake. The church's windows were blown out, and the building located at the entrance was destroyed, but the church exterior suffered minimal damage. Authorities reported that five people and two perpetrators were killed.

Second The second attack occurred around 07:45 at the GKI, located on Diponegoro Street. Eyewitnesses said the perpetrator was a woman wearing black veil and black niqāb. She was also carrying two bags. At the time of the incident, she was taking her two children, who were also wearing veils and niqābs. Eyewitnesses said the woman was trying to enter the church when a security officer named Yesaya Bayang suddenly blocked her. She then hugged the security officer and detonated the bomb. Not long after that, her children detonated their explosive devices. Explosions were heard as many as five times. The security guard who tried to stop them was critically injured by the blast. No civilian casualties were reported, but the three perpetrators were killed.

Third The third attack occurred at the GPPS, located on Arjuno Street on 07:53 WIB. At least two explosions were heard in the third attack. The first explosion originated from a Toyota Avanza. According to eyewitness, the driver of the car rammed the entrance gate and struck parked vehicles in the church. At the time, people were going to drive their vehicles out. The explosion destroyed five cars and 30 motorcycles. Two people were initially reported killed, and many were injured, several seriously. Another bomb exploded from the same car. Two other bombs were discovered near the church, forcing a bomb disposal unit to be dispatched. According to them, two bombs were successfully detonated while the other two malfunctioned. Authorities later said ten civilians and the perpetrator were killed.

Emergency services arrived approximately two minutes after the first attack. The East Java Regional Police said that a total of 28 people were killed and 43 more were injured in the three attacks, with several in critical condition. The police immediately cleared and cordoned the area.

Fourth Around 20:00, a bomb exploded at the Wonocolo apartment complex in the nearby city of Sidoarjo. The incident occurred when the police raided the apartment. Three adults in a single apartment room were killed, while three children occupying the same room survived, all from the same family. According to the regional police chief Inspector General Machfud Arifin, the victims might have been planning to conduct attacks similar to the ones perpetrated at the churches, but the devices exploded prematurely.

Nearby residents said they thought the explosion was caused by exploding liquid petroleum gas. Residents who lived in or nearby the apartment complex were evacuated from the vicinity. The police later added that residents were prohibited to return to their homes until further notice. Police cordoned the area for investigation, and roads nearby were closed. Accounts from eyewitnesses revealed that two eleven-year-old children were severely injured in the blast; they were immediately evacuated. At least five explosions were heard.

Fifth On 14 May, multiple suicide bombings occurred at the Surabaya Police headquarters (Mapolrestabes Surabaya) on 08:50 WIB. The East Java Regional Police said two bombers detonated their devices at the building checkpoint. Police said four policemen and six civilians were wounded, while four suicide bombers were killed.

The attack, which occurred at the entrance of the police headquarters, was captured on camera. The video showed a black Toyota Avanza entering the checkpoint when four people riding two motorcycles suddenly entered the area. The motorcycles were halted by a group of policemen, after which the perpetrators detonated their explosive devices. In the video, one of the perpetrators was a woman.

In the aftermath of the attack, an eight-year-old child, whom the police suspect was the perpetrators' daughter, was brought to the police station to assist in the attack, was found walking and screaming amidst the bodies. Police said she was in critical condition.

Police immediately closed nearby roads. Businesses and shops were ordered to be close in the vicinity of the area. All kinds of service in the police headquarters were temporarily terminated in response to the attack.

Casualties As of 1 June 2018, 15 civilians and 13 suicide bombers were killed. Among them were children aged 11 and 8, identified as Evan and Nathan, and two security officers who were trying to stop the perpetrators from entering the churches. Aloysius Bayu Rendra Wardhana, a security volunteer; and Yesaya Bayang, a security officer, were regarded as heroes by locals for successfully stopping the perpetrators from entering SMTB and GKI Diponegoro, respectively. A security officer succumbed to his injuries on 19 May. Another victim succumbed to his injuries 18 days after the bombings.

Injured victims of the blasts were treated in eight hospitals. The local branch of the Indonesian Red Cross reported an upsurge in blood donations, with 600 people donating blood that day compared to the routine target of 400.

Investigation Hours after the attacks, the Chief of the Indonesian National Police Tito Karnavian, said in a news conference that Jamaah Ansharut Daulah, a local branch of the Islamic State, was the group responsible for perpetrating the attacks. The group was responsible for the previous church bombing in Samarinda in 2016 and was also blamed for a series of attacks against Indonesian police in 2016 and 2017.

He later added that based on eyewitness accounts, the attackers were probably from the same family. Multiple people claimed that prior to the attack, the woman and her two children involved in the second attack were dropped off from a Toyota Avanza. According to Tito, the man who drove the Avanza was her husband. He then drove the car away and conducted the third attack. Their sons were the ones who drove the motorcycle in the first attack.

According to official reports, the perpetrators had recently returned from "education" in Syria. The family, according to Tito, was among the 500 people who were being monitored by the government.

Australian counter-terrorism expert Professor Greg Barton of Deakin University said the perpetrators were "self-contained", deliberately cutting off communication with the other members via digital communications to avoid detection from the police. According to him, this was similar to the November 2015 Paris attacks. He later added that the weak anti-terror law in Indonesia allowed local extremists to travel to Iraq and Syria with ease, and that those who might have been involved with the Islamic State wouldn't be punished by the authorities. There was also considerable concern of the use of children in terror attacks.

Motive Indonesian National Police revealed that the attacks were directly ordered by ISIL as revenge for the imprisonment of Aman Abdurrahman, the leader of JAD and JAT in Indonesia. Abdurrahman should have been released from jail in August 2017, but he was arrested again for supplying weapons and funds for the terrorists who executed the 2016 Jakarta attacks. He was in prison at the time for his role in conducting training for terrorists in Aceh.