PDRM Begins To Investigate JPN Database Leak As LHDN Refutes Seller’s Claim

The Royal Malaysian Police (PDRM) has begun to investigate the database leak that is said to involve the National Registration Department (JPN) and Inland Revenue Board (LHDN). As per our report earlier, a database that apparently contained four million data that belonged to Malaysians was put on sale at a well-known marketplace forum.

The seller claimed that the data was from JPN but acquired through LHDN’s website using myIDENTITY’s API. It was listed on the marketplace for 0.2 BTC which was around RM 35,495 at the time we published the report this morning.

According to the Director of PDRM’s Commercial Crime Investigation Department, CP Mohd Kamarudin Md Din, a police report regarding the incident has been filed at Putrajaya by the Deputy Director of JPN and the case is currently being investigated under Section 4(1) of Computer Crimes Act 1997 [pdf].

CP Kamarudin added that a thorough investigation will be carried out in collaboration with the Malaysian Communications and Multimedia Commission, CyberSecurity Malaysia, and National Cyber Security Agency (NACSA). Interesting enough, the police are not ruling out the involvement of insiders in this incident.

PDRM reportedly has also made the first move by attempting to block the sale of the database although our quick visit to the marketplace forum showed that the listing is still there in the marketplace forum as of 9:30 PM today.

In a separate statement, LHDN has refuted the claim that its website was the source of the database leak and insisted that it is just a user of myIDENTITY but does not own the platform. The board has also revealed that its own internal investigation showed that there was no leak of data and information at its end.

LHDN insists that all of the data and information under its custody is safe and protected by “recognised data security technology”. That being said, it is currently working together with JPN, NACSA, and National Security Council to go through all the possibilities in regards to the said database.

Database Seller Strikes Again: Personal Data of 10 Million Malaysian Voters Could Be On The Line

Following the databases that were said to contain information about E-Pay Malaysia and Ifmal customers, there is a new listing that claimed to have 10 million Malaysian voters in its database. The listing took place last weekend on the same marketplace forum that featured the two previous databases.

First reported by OMG Hackers, it was put up by the same seller that claimed to have the personal information from 200,000 Ifmal customers which have since been refuted by the e-commerce platform.

The images that the seller has included in the listing also contained a reference to the #KitaMintaLima hashtag that has gone viral on Twitter recently. The seller also claimed that the database is being split according to individual birth years from 1950 to 1996.

Aside from names, the seller also claimed that the database contains other details such as IC numbers and addresses. Also noticeable in the screenshots within the listing are voters’ areas and localities as well as their assigned state legislative and parliamentary zones.

The seller didn’t put up any pricing inside the listing although it was noted that buyer has to pay for the database using either Monero or Bitcoin. Four days have passed since the listing went online but the Election Commission of Malaysia (SPR) has yet to release any official statement regarding it even though the commission is already aware of the listing according to a report by Harian Metro.

That being said though and you may not be aware of this but the electoral roll (DPPR) can actually be purchased directly from SPR. Of course, only a select group of organizations such as political parties can get their hands on the DPPR which comes in the form of physical book and CD.

The pricing of the DPPR for each state legislative and parliamentary zone are different from one to another as it is generally based on the number of voters within respective zones. During the 14th General Election (PRU 14) in 2018, the complete DPPR for the whole Malaysia which contained 14,940,624 voters was priced at RM 60,520.20 by SPR [pdf].

So, if the claim by the sellers of the so-called leaked voters’ database is true, that means the database is likely to be incomplete. Nevertheless, SPR and related authorities need to address this matter urgently since not only it involved personal data that belonged to millions of Malaysians but it has also cast doubts on the ability of SPR and local political parties or whoever that has access to the database, to safeguard the information.

Seller Claims Fresh Database Sold Online Contains Details of 200,000 Malaysians

We have received a tip that another set of personal data that belongs to Malaysians have been listed online. It was listed on the same marketplace that featured the alleged E-Pay Malaysia database earlier this week.

According to the listing, the seller claimed that the database contained 200,000 entries and includes information such as name, address, phone numbers, and IC number. The seller also stated that the database belonged to the local e-commerce platform, Ifmal.

However, Ifmal has since refuted that claim through a statement on its official Facebook page. According to the post, the e-commerce company apparently don’t that many customers in its database and Ifmal also never asked for buyer’s IC number.

We have checked Ifmal’s claim ourselves and it is indeed true that the platform did not ask for user’s IC number. In general, the information that the platform asked from its customers are quite different, as shown in the screenshot below:

So, now comes the important questions: who is the actual owner of the said leaked database? Is it even real? Regardless of the answer though, we believe relevant authorities may want to look into this so-called fresh data leak anyway as it is better to be safe than sorry.