Act swiftly to prevent further data breaches

THE allegation that the personal data of 22.5 million Malaysians born between 1940 and 2004, purportedly from the National Registration Department (NRD), have been stolen and sold on the dark web is a serious concern.

According to local tech portal Amanz, the 160GB database containing information such as a person’s name, identity card number, address, date of birth, gender, race, religion, mobile number, and Base54-based photo, is being sold for US$10,000 (about RM43,885) at a well-known database marketplace forum.

In a screenshot shared by the portal, the seller claimed that the database was an expanded repository from the one he sold in September last year.

In the incident last year, the personal data of four million Malaysians were allegedly leaked from the MyIdentity API (application programming interface) and put up for sale at RM35,419.

MyIdentity is a national data-sharing platform that allows government agencies to access individuals’ details from a centralised repository.

This is not the only government database that has been put on sale this year. Apparently, a couple of weeks earlier, the same seller had posted a database allegedly belonging to 802,259 Malaysian voters, obtained from the Election Commission’s website, on the black market.

And sadly, these are not the only incidences of government database breaches.

While the Home Affairs Ministry has denied that the latest database leak was from NRD, the police, on the other hand, have already started their investigation into the breach.

But whatever the outcome is, with the rising number of cases involving government personal data leaks, the authorities must be held accountable for such breaches.

Heads, especially those given the task of ensuring the safety and security of these public data, must roll.

They must be held accountable for their failure in protecting the people’s interests and in ensuring the safety and security of their private details, which could easily be abused.

The government must also act swiftly to address the weaknesses in their system and reassure Malaysians of a better solution to safeguard data stored by government departments and agencies.

It is a question of public safety.

Scammers could use the stolen data to cheat people of their money, while telemarketers would have a field day making unsolicited calls from the leaked telephone numbers of Malaysians.

To prevent leaked data from being misused, the government, including the police, must work harder to go after scammers, who could use such information to trick victims, especially via the Macau scam.Last year, 1,585 Macau scam cases were reported nationwide, resulting in RM560.8mil in losses. This year, the number has already reached 1,258 cases as at April 19, involving RM65.4mil in losses.

As for telemarketing, the Malaysian Communications and Multimedia Commission (MCMC) must be more vigilant and introduce sterner measures to prevent unsolicited calls.

Actions to stop the scammers and unsolicited calls would restore people’s confidence in government agencies despite the data breach.

Lastly, as the custodian of all Malaysians’ data, the government must also be held accountable for any breach.

Currently, the Personal Data Protection Act 2010 (PDPA) does not apply to the federal and state governments. Instead, it only covers commercial entities.

While proposals to amend the PDPA, including making the government accountable, have been made, the amendments have yet to be tabled in Parliament.

Therefore, lawmakers should seriously consider the urgency of the amendments to make Malaysians’ personal data safer in the public domain, preventing them from falling into the wrong hands for illegal use.

This has to be done quickly to prevent more of such data breaches before it is too late and puts national security at risk.