It only takes one attack. For seven years, Indonesia, the nation with the world’s largest Muslim population, had prevented militants from launching major terrorist acts on home turf. But on Thursday, an audacious assault on the Indonesian capital Jakarta destroyed any sense of complacency in a country that prides itself on its largely secular government, religious diversity and elite counterterrorism force.

At least five militants — some armed with suicide explosives, still others with handguns — struck in front of the Sarinah mall, attacking a Starbucks and a police post before unleashing a running gun battle on one of Jakarta’s main thoroughfares. By the time the smoke had cleared hours later, two civilians had perished, one Indonesian and the other Canadian. Five attackers also died.

Soon after, the Islamic State of Iraq and Greater Syria (ISIS) claimed responsibility for the strike, saying that its “crusader alliance” had orchestrated the deadly raid. In recent weeks, ISIS has murdered in Istanbul, Paris, Beirut, California, Afghanistan and Iraq, in addition to continuing its deadly reign in its home base of Syria. Now the rest of Asia has been inducted into ISIS’s zone of terror.

Indonesian authorities say the attack — which relied on smaller strikes, rather than one massive, high-tech bomb — was inspired by the November Paris attacks that killed 130 at six separate locations. The Jakarta death toll was, thankfully, far lighter. Although 20 people were wounded, with some in critical condition, so far more attackers have died than civilians. Nevertheless, the fact that deadly violence happened at all — even after Indonesian police acknowledged a heightened threat status based on intelligence about a possible attack — proves the power of ISIS and its army of foreign fighters.

Hundreds of Indonesians who joined ISIS in Syria and the Middle East have returned home. More than 50 Indonesians have been killed in fighting there. The Indonesian Ministry of Foreign Affairs says that in 2015, 210 Indonesians, some women and children, were deported from six countries for allegedly trying to join ISIS by way of these third nations or for already being members of ISIS. The largest contingent was repatriated from Turkey. But Indonesia, a sprawling democracy, has no consistently enforced regulations in place preventing citizens from going to Syria to join ISIS — or from coming home after their jihadist experiences.

On Thursday, Jakarta police chief Tito Karnivian named Bahrun Naim, a former Internet café manager from the Indonesian city of Solo, as the mastermind of the Jan. 14 attack. Police believe Bahrun is now based in Raqqa, the Syrian city where ISIS is centered, having moved to the Middle East in early 2015 after spending more than two years in an Indonesian jail for illegal arms possession. “[Thursday’s] attack was a wake-up call,” says Ansyaad Mbai, the former head of Indonesia’s counterterrorism force. “Indonesian jihadists are no different from the terrorists in Paris because they have the same quality: they are not afraid to sacrifice their lives.”

The vast majority of Indonesia’s Muslims practice a moderate form of the faith laced with local mysticism — starkly different from the puritanical Salafi strain that has spread from Saudi Arabia and inspired Islamic militancy across the world. Still, Indonesian mosques adhering to conservative ideology have been showered with Saudi money, and more urban Indonesian women are now wearing overt symbols of the religion like the veil.

The country has suffered multiple bombings in the past, most notably an attack on the resort island of Bali in 2002 that killed 202 people, many of whom were foreigners. Various symbols of the West or the Indonesian state were then targeted, including five-star Western hotels, Christian churches, the Australian embassy and police stations. The most recent large-scale strike took place in 2009, when suicide bombers killed seven people in the Ritz-Carlton and J.W. Marriott hotels in Jakarta.

Those attacks were linked with Jemaah Islamiah (JI), a local al-Qaeda affiliate that built a sophisticated network of jihadists and bombmakers, some of whom had trained in Afghanistan and other foreign terrorist-breeding grounds. In the intervening years, however, Indonesian counterterrorism forces, led by the Densus 88 squad, shot and jailed JI into submission. Key masterminds were killed in high-profile raids, even as some Indonesian clerics continued to call for jihad in pursuit of an Islamic caliphate. (Indonesia’s founding principles include a commitment to monotheism but do not specify Islam as that unitary faith. The country boasts at least 20 million Christians, including Jakarta Governor Basuki Tjahaja Purnama, also known as Ahok.)

But even if JI seems a diminished force, terrorism experts have warned for months that Indonesia — a vast archipelago of some 6,000 inhabited islands flung across the equator — was vulnerable to ISIS. In a 2014 survey, Al Chaidar, an Indonesian scholar who studies extremist Muslim movements, says he recorded 2 million ISIS followers in Indonesia, a nation of more than 250 million people. Complicating matters, at least three influential local entities claim to represent ISIS in Indonesia, one operating out of eastern Indonesia and two in Java, the nation’s most populous island where Jakarta is located.

The earliest suspected militant to have publicly expressed support for ISIS is Abu Wardah, or Santoso, the head of the East Indonesia Mujahidin (MIT) group. Dubbed Indonesia’s most-wanted terrorist, Santoso remains at large, presumably in the jungled central swath of the eastern Indonesian island of Sulawesi, possibly with a squad of foreign fighters arrayed around him, including members of the Uighur ethnic group from northwestern China. Indonesian police say that Bahrun, the alleged mastermind of the Jan. 14 Jakarta attack, had previously been in contact with Santoso. Jakarta police chief Karnivian, using a different acronym for ISIS, says that Bahrun “wants to become the leader of the Southeast Asian IS branch.”

Densus 88 has been lauded for its success in foiling terrorist attacks and dismantling terror cells. In December, Indonesian antiterrorist forces arrested more than a dozen people suspected of preparing to unleash a terrorist campaign around Christmas or the New Year. Among the materials found during the raid were a map of greater Jakarta and suicide vests. On Thursday, Indonesian authorities said that some of those captured last month had been in contact with Bahrun in Syria.

But Indonesian counterterrorism forces have been less skilled in preventing the radicalization of young men, often in prison where jail sermons have bred a new generation of militants. (Densus 88 has also been criticized for its lethal dispensation of force in antiterrorist raids.) One of Thursday’s suspected attackers met a radical cleric, Aman Abdurrahman, while in prison, according to Chaidar. Retired antiterrorism chief Ansyaad says that prison guards often receive threats from militant groups and therefore allow convicted terrorists more latitude in jail. “They can do their sermons, they don’t have to wear prison clothes, they can have their own kitchens so they don’t have to eat prison food,” he says. “All of these actions are tolerated because the jailers are worried about their own safety.”

While Thursday’s attack in Jakarta didn’t bring with it the destructive force of the 2002 Bali bombing or other ISIS raids in recent weeks, the return of battle-hardened Indonesians from Syria or their release from local jails is of great concern to terrorism experts. “Of course I’m worried about more attacks because deradicalization is not working,” says Chaidar, who teaches at the University of Malikussaleh in Aceh. “Militant radicals believes that if you sweep a country clean, they will be able to expand and create a caliphate.” Indonesia is now formally part of ISIS’s violent command.

— With reporting by Muktita Suhartono / Jakarta

Get The Brief. Sign up to receive the top stories you need to know right now. Please enter a valid email address. Sign Up Now Check the box if you do not wish to receive promotional offers via email from TIME. You can unsubscribe at any time. By signing up you are agreeing to our Terms of Use and Privacy Policy . This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. Thank you! For your security, we've sent a confirmation email to the address you entered. Click the link to confirm your subscription and begin receiving our newsletters. If you don't get the confirmation within 10 minutes, please check your spam folder.

Contact us at letters@time.com.