Five nabbed over theft, sale of M'sians' personal data

Five people have been arrested for their suspected involvement in a syndicate that hacked and stole 400 million personal data records of Malaysians before selling them on the dark web, police said.

Bukit Aman’s Commercial Crime Investigation Department (CCID) director Ramli Mohamed Yoosuf said the suspects, aged between 34 and 52, were arrested during Op Kapas in Kuala Lumpur on Sept 5.

The suspects comprised four locals and one Pakistani national, who is believed to be the syndicate mastermind.

Ramli explained that the syndicate stole personal data by hacking into systems used by various companies and related agencies.

The stolen information, including names, identity card numbers, home addresses, bank account details and mobile phone numbers, was then uploaded to a portal known as Query Smart Search, he said.

“Access to this portal was rented out to interested individuals at a rate of RM200 to RM800 per month. Some data was also sold directly to buyers for between RM1.50 and RM2 per record,” he told a press conference today.

Also present at the press conference were Malaysian Personal Data Protection Department commissioner Mohd Nazri Kama and CyberSecurity Malaysia chief technology officer Wan Roshaimi Wan Abdullah.

Website monitoring

Ramli said CyberSecurity Malaysia initially detected the syndicate’s activities after monitoring a website, dataserver1.mypsx.net, containing user information believed to be registered with various companies and agencies.

He said most of the identified renters and buyers were unlicensed debt collection companies, and the authorities also believe that other syndicates may have used the services of this syndicate.

The Pakistani national was charged on Oct 11 with two counts under Section 130(4) of the Personal Data Protection Act 2010 for selling personal data and could be punished under Section 130(7) of the same act.

“The 47-year-old Pakistani man entered Malaysia as a general worker about 10 years ago but is believed to have been involved in hacking for about a year,” he said.

The other four suspects, three believed to be unlicensed debt collectors, were released on police bail, he added.

- Bernama

Padu: KJ to lodge report over identity theft

MyDigital ID rolls out online registration via mobile app

COMMENT | Malaysia's blueprint to block cyber attacks

Authorities visit AirAsia over alleged data breach

Govt to look into cyber security, protection of personal data

Govt has lead on alleged civil servant e-payslip data theft