Malaysia has reported eight cases of significant personal data leakage involving 67.5 million personal records on users in Malaysia, according to Special Functions Minister Abdul Latiff Ahmad.

These data breach cases were caused by vulnerabilities in the system and violation of security policies, he said in a written parliamentary reply.

"Based on the monitoring by National Cyber Coordination and Command Centre (NC4), between 2011 and 2021, eight cases of significant personal data leakages involving 67.5 million have been recorded stolen and sold on the black market," he said.

"This amount was based on the cases reported and covered by the media," Latiff (above) said.

"Among the reasons for personal data breach incidents were the involvement of insiders as masterminds, breaches of established security policies and vulnerabilities in the system that led to manipulation for the purpose of obtaining data from the databases."

He said the government enforced Personal Data Protection Act 2010 and established the Personal Data Protection Department (PDPD) to ensure personal data is protected.

"The role of PDPD is to ensure compliance via awareness activities, good practice advice, providing general advice and guidance," he said.

The department will also regulate the processing of personal data of individuals involved in commercial transactions by data users and carry out enforcement to combat the misuse of personal data.

In September, Communications and Multimedia Minister Annuar Musa reportedly urged the country not to take data security for granted even though Malaysia was recently ranked among the top 10 countries with a high commitment to cybersecurity.

"Malaysia is ranked fifth in the world by the International Telecommunications Union (ITU) in terms of cyber security, which is good. But that does not mean that we are not vulnerable. When we create a cyberspace ecosystem, it comes with threats.

A massive data breach involving the personal data of 46 million mobile subscribers in Malaysia leaked onto the dark web in 2017.

Last year, the police attempted to block an attempt to sell 31.8gb worth of personal data originating from the National Registration Department (NRD) and the Inland Revenue Board (IRB) on a hacker forum.