Malaysia's Repeated Data Breaches, Ignorance or Weak Enforcement?

Personal data carries real value, and when it is poorly protected a single breach can expose millions of people at once. Malaysia learned this in 2020, when a large breach laid bare the personal details of millions of its citizens. The public was angry and the government pledged to clamp down, yet over the following two years further breaches compromised the records of millions more Malaysians. That record raises an obvious question: is the problem a lack of understanding, or enforcement that is too soft?

The December 2022 leak and the minister's inquiry

In December 2022 close to 13 million Malaysians were affected by a major breach said to involve three organisations: Maybank, the satellite broadcaster Astro and the Election Commission. Fahmi Fadzil, the Communications and Digital Minister, opened an inquiry, and questions followed about the country's level of cybersecurity and how the government was handling it.

Of the three organisations named, only Maybank has contested the breach. The bank denied it at first. On December 26, 2022, the threat intelligence platform ThreatMon posted on Twitter that it had found material linked to the breach on dark web forums. Fadzil then instructed the Personal Data Protection Department and CyberSecurity Malaysia to look into the matter and act accordingly.

There was speculation that all three organisations had been hit. The investigation, however, concluded that the Maybank account details circulating on the forums were either wrong or did not exist. Whether Astro and the Election Commission were actually breached remains unclear. Either way, the episode renewed worries about Malaysia's security posture and the need for firmer measures to stop the next incident.

Why the PDPA did not apply to the Election Commission data

With breaches recurring, doubts have grown over whether Malaysia's data protection and cybersecurity arrangements are adequate. During the inquiry, Fadzil disclosed that the Election Commission's data is not covered by the Personal Data Protection Act 2010. Responsibility for it lies instead with the National Cyber Security Agency.

The Act governs how personal information is collected and used in Malaysia. It applies to organisations handling personal data in commercial transactions and sets rules for gathering, using and storing that data. It also gives individuals rights, among them the right to view their own data and to ask for errors to be fixed.

The Election Commission is a government body that supervises and runs Malaysia's elections. Because it handles voter information in a public capacity, it answers to different rules from commercial firms and sits outside the Act. It is one of several government agencies that depend on the National Cyber Security Agency to safeguard voter data and prevent intrusions.

Since the Act does not cover the Election Commission data taken in the latest breach, no offence under it was committed. Fadzil has nonetheless moved to block further access to the website on which the stolen data appeared.

The leak reaches well beyond the Election Commission. The private details of ordinary Malaysians were exposed too, and this has happened before. However many millions of records are stolen or leaked, little seems to change. The incidents recorded in 2022 alone show the scale:

Date	Event
December 30	A data leak at Maybank, Malaysia's largest bank, affected 13 million account holders, with the data posted on an online database marketplace. In a separate listing, a seller claimed to hold the personal database of mobile customers of internet provider Unifi.
November 28	A database of 487 million WhatsApp users' mobile numbers, 11 million of them Malaysian, was reportedly offered for sale on a hacking forum. According to the source, accounts from 84 countries were included.
November 10	Hackers broke into the database of Malaysia's election regulator. The stolen data covered registered voters' MyKad numbers, full names, email addresses, passwords, home addresses, pictures and identity card numbers, and was sold for USD $2,000 payable in Bitcoin or Monero.
November 5	Malaysian budget airline AirAsia suffered a Daixin ransomware attack that put the personal information of five million passengers at risk.
October 25	A breach hit about 2.6 million Carousell users in Malaysia and Singapore. The attackers published account creation dates, usernames, full names, email addresses, phone numbers and other details. A bug in a system migration let a third party gain unauthorised access to the company's database.
September	Hackers presenting themselves as a "grey hat" cybersecurity group claimed to have breached ePenyata Gaji, the civil service e-payslip system, and reached over a million rows of identities in its database.
September	Malindo Air, since rebranded as Batik Air, leaked the email addresses, dates of birth, addresses, passport numbers and phone numbers of 45 million customers online.
August	Customers' card data was compromised at payment gateway iPay88 after a cybersecurity incident. The company opened an investigation and called in experts to contain it.
May	Millions of datasets from the National Registration Department (NRD) appeared on the dark web, including personal data of Malaysians who registered for identity cards between 2000 and 2018.

Promises after a breach, penalties elsewhere

The pattern is familiar. A company suffers a huge breach, vows to improve, and then very little follows. Whatever commitments are made afterwards, companies are rarely held to account for what went wrong.

Other countries, among them Australia, the UK and South Korea, have put firm breach policies in place, with fines and penalties for companies that fail to protect customer data. Australian law obliges companies to notify the Office of the Australian Information Commissioner of any breach, and failing to do so can bring fines of up to AUD $2.1 million (about USD $1.5 million). In the UK, a company that fails to protect customer data can be fined as much as 4% of its annual turnover. South Korea's strict data protection laws require companies to tell customers straight away when a breach occurs.

Several large companies have been hit with heavy penalties over the past two years:

• In summer 2021, officials in Luxembourg fined Amazon €746 million (USD $877 million) for breaching GDPR. Amazon is reported to be appealing, arguing that there was no breach and that no customer data reached any third party.
• In September 2022, Ireland's Data Protection Commissioner (DPC) fined Instagram USD $403 million for breaching children's privacy under GDPR. The long-running complaint was about minors' data, in particular phone numbers and email addresses. Meta, which owns Instagram, intends to appeal and disputes how the fine was worked out.
• In July 2022, T-Mobile said it would pay a total of USD $350 million to settle a consolidated class action over a breach in early 2021 that affected an estimated 77 million people. The case concerned "unauthorised access" to its systems after part of its customer data was put up for sale on a known cybercriminal forum. The operator also committed to an extra USD $150 million in total spending on data security and related technology across 2022 and 2023.
• In August 2021, WhatsApp, the Facebook-owned messaging service, was fined €225 million (USD $255 million) in Ireland over a series of cross-border GDPR infringements. The penalty came after a long investigation and enforcement process that started in 2018, during which other European data protection regulators rejected the Data Protection Commission's proposed decision and sanctions.
• In December 2021, the Irish data watchdog fined Meta, Facebook's owner, €265 million over a breach that exposed data on more than 500 million users. The Data Protection Commission found that Meta had breached two articles of EU data protection law after Facebook users' details worldwide were scraped from public profiles in 2018 and 2019. Along with the fine, the DPC issued a reprimand and ordered Meta to bring its processing into compliance through specified remedial steps within a set period.
• In December 2021, Capital One agreed to pay USD $190 million to settle a class action brought by US customers over a 2019 breach affecting 100 million people. The settlement came more than a year after the US Office of the Comptroller of the Currency fined the bank USD $80 million for the same incident.

Hundreds of other companies around the world have likewise been sanctioned or faced legal action over breaches. Not every case is reported, though, and some laws are not strictly enforced. Much depends on the country and how it regulates.

In Malaysia the absence of accountability is a serious concern, given how often breaches now occur and the harm that stolen personal data can do. The argument is that Malaysia needs to treat breaches seriously and apply penalties that make companies answer for their failures. Without real consequences, the broken promises and inaction seen so far are likely to continue.

What lies behind Malaysia's cybersecurity problems

Several causes have been blamed for the country's difficulties: too little funding and too few resources, weak staff training, and poor coordination and communication between government and business. Organisations can still take steps to avoid being the next breach victim, and two security vendors, Kaspersky and Qualys, offered their views on what those steps should be.

Chris Connell of Kaspersky stressed training and educating staff. In his view many breaches happen because employees do not grasp why preventive measures matter, and education that is engaging and relevant lowers the chance of a breach.

Debashish Jyotiprakash of Qualys recommended a risk-based approach, in which risk is quantified across vulnerabilities, assets and groups of assets so that a company understands its own risk posture. He added that a zero-trust model, which treats every access request as malicious until shown otherwise, helps keep data safe.

Both men pointed to partnerships between the public and private sectors, with open channels for sharing threat intelligence, joint training and a shared goal of stopping attackers and protecting consumers. The challenge looks large, but organisations that invest in security, train and educate their people and work with public and private partners can strengthen their defences and reduce the chance of being breached.

Stronger data security for the years ahead

Malaysia faces growing cyber threats, and keeping the country safe and independent calls for a joint effort by government and citizens. The National Cyber Security Agency (NACSA) is central to countering those threats, and its success depends on a skilled workforce and on proper standards and best practices. NACSA can only do its work, however, with a solid governance framework behind it that supplies the resources it needs.

As threats change, Malaysia increasingly has to act in advance to keep its cyberspace secure, and doing so nationally will take everyone involved working together. Keeping the internet free while protecting the nation's values is a delicate balance.

It would be hard to overstate how much stronger cybersecurity will matter for Malaysia. As digitalisation accelerates, governments need the means to keep pace with new threats and protect their people. Keeping ahead and safeguarding the country's cyberspace for later generations will require a sustained, collective effort over the next five years and beyond.