PETALING JAYA: The Communications and Multimedia Ministry (K-Komm) has launched an investigation into a website that allegedly sold Malaysians’ personal data openly on the Internet.
K-Komm Minister Tan Sri Annuar Musa said his ministry worked with the Department of Personal Data Protection (JPDP), Malaysian Communications and Multimedia Commission (MCMC) and Cybersecurity Malaysia to delve into the website’s content and background after it was highlighted by a Twitter user.
ALSO READ: Data of Malaysians born between 1940 and 2004 allegedly being sold for over RM40,000
“An instruction to block the website was issued to the Internet service provider, including restricting the buying and selling of data on the website.
“Steps to take down the website were carried out at around 6.30pm on the same day,” Annur said in a statement.
He added that the ministry is also collaborating with various agencies, including the National Cyber Security Agency (NACSA), Royal Malaysia Police (PDRM) and Bank Negara Malaysia, in its investigation into the website.
ALSO READ: Database containing personal info of four million Malaysians allegedly being sold online
It said offences in relation to the sale of personal data are punishable by a fine not exceeding RM500,000 or imprisonment not exceeding three years, or both, under Section 130 of the Personal Data Protection Act 2010.
On June 12, Twitter user @Radz1112 or Cyber Guardian highlighted the existence of the website, which allowed a person to be searched by details like name, address, phone number, MyKad or military ID or date of birth.
Searching a person by the MyKad ID, for instance, will reveal the person’s full name, date of birth, gender and house address. The information was being sold for just a few ringgit.
ALSO READ: Malaysians’ personal data allegedly being sold openly on the Internet
Cybersecurity experts believed that the website was made by Malaysians or those familiar with the local market as it provides a page for customers to purchase cryptocurrency locally, which is required to buy the information.
They also believed that the website may have correlated data from publicly available information, third party APIs (application programming interfaces) and possibly previous data leaks.
Meanwhile, the security of personal data belonging to the Federal government and the state government will be ensured by the relevant government agencies and NACSA, said Annuar.
He advised the Federal and state governments to apply the seven principles of PDP as guidelines or best practices to protect people's personal data.
The Communications and Multimedia Consumer Forum of Malaysia (CFM) urged Malaysians to file a complaint to JPDP if they believed that their personal data had been compromised.
“If CFM receives any complaints related to personal data leaks, we will channel them to JPDP,” CFM said in a statement.
Meanwhile, JPDP said it will conduct a preliminary investigation into any complaints to determine if there has been a breach under the Personal Data Protection Act 2010.
“The time required to investigate depends on the complexity of the complaint or the case reported,” JPDP said.
It also encouraged members of the public to file complaints related to data breaches on its website.
