PROBE INTO SALE OF PERSONAL DATA

This follows seller’s claim about having personal data of 22.5m Malaysians, allegedly harvested from NRD

THE Home Ministry will investigate individuals who allegedly attempted to sell the personal data of 22.5 million Malaysians on the Internet.

Minister Datuk Seri Hamzah Zainudin said a full investigation would be carried out and that those involved would be called in.

He, however, said the data breach was not from the National Registration Department (NRD).

Hamzah said an investigation carried out by the ministry found that the data was from a collection of sellers from other sources.

“We (at the ministry) have a mechanism to verify that the leaked data is not from the NRD.

“As in previous cases, the sale of data involves several agencies to whom we have given some leeway to obtain information from the department,” he said at the Home Ministry’s Hari Raya Aidilfitri open house in Putrajaya yesterday.

The data breach was highlighted by Lowyat.Net, which came across the data sale on a tech site last month.

The portal reported that the breach involved data of Malaysians born between 1940 and 2004, and was 160 gigabytes in size. The data included people’s names, MyKad numbers, addresses, dates of birth, gender, race, religion and mobile numbers.

The seller, who claimed to have the data of 22.5 million Malaysians, also posted a screenshot of Hamzah’s details as proof.

The data is claimed to have been harvested from the NRD. The seller also mentioned in his offer that the source of the 160GB file is the government-owned myIDENTITI API system, which is shared by several government agencies.

This is the second time that such sensitive personal information was publicly put on sale on the Internet.

The first incident in September last year involved the personal data of four million Malaysians.

The New Straits Times has contacted the police to verify the data leak, but has yet to get an official response.

Meanwhile, Hamzah said the standard operating procedure to obtain personal data through the agencies under NRD would be reviewed.

“The NRD feels that there is a need for personal data to be obtained directly from the department concerned so that issues like this do not arise.”