SHAH ALAM - The alleged Khairul Aming–Maxis data leak has renewed concerns over whether Malaysia’s personal data protection framework offers equal protection to all consumers, as high-profile cases often appear to receive faster attention compared with similar data misuse issues affecting ordinary Malaysians.
Cybersecurity practitioner Murugason R Thangaratnam said the incident highlighted broader weaknesses within Malaysia’s cybersecurity ecosystem.
“The alleged Khairul Aming–Maxis data leak has highlighted persistent weaknesses in Malaysia's cybersecurity and personal data governance, which continue to rely heavily on internal controls and employee trust rather than robust, end-to-end security measures.
“Even if the incident is ultimately found to be an isolated case of unauthorised access, it demonstrates how a single insider may be able to bypass existing controls, access sensitive customer information such as billing and account details and distribute it online,” he told Sinar Daily.
Murugason, who is also an adjunct practice professor at UNIMY, said the case also reflected long-standing public concerns that personal information continues to end up in the hands of telemarketers, agents and scammers despite Malaysia having the Personal Data Protection Act (PDPA) since 2010.
He said while audit trails and logging systems remained important, they were largely reactive because they often identify misconduct only after a breach has occurred.
“Increasingly, Malaysians expect organisations to adopt proactive risk management, stronger access controls, privacy-by-design principles and independent oversight that prevent such incidents from happening in the first place,” he said.
The alleged breach involving entrepreneur and influencer Khairul, emerged after he questioned how his personal phone bill details, payment history and other private information were obtained and shared publicly online.
Khairul later lodged reports with the Malaysian Communications and Multimedia Commission (MCMC), Personal Data Protection Department (JPDP) and Dang Wangi District Police Headquarters, while issuing a Letter of Demand to telecommunications provider Maxis.
“"My lawyers will take over this case until it is resolved. Honestly, I feel sad and terrified that personal privacy can disappear so easily.
"Phone details, payment history, subscription records, even my identity card number that can be used to access MySara, everything was leaked,” he wrote on Threads.
Maxis previously said it had identified an individual allegedly involved in unauthorised access to a customer’s account details and had taken immediate action.
Murugason said the case had also revived concerns over whether ordinary Malaysians receive the same level of protection as public figures.
“The attention given to Khairul Aming’s case, which involved ministerial involvement, regulatory scrutiny by MCMC and a swift corporate response, has highlighted a contrast with the experiences of many ordinary consumers facing alleged data misuse.
“For many Malaysians, such issues often emerge through scam calls, unsolicited marketing or nuisance messages, with limited public attention or visible enforcement action.
“Although legal protections apply equally regardless of an individual’s status, enforcement is often perceived as more decisive when cases involve higher reputational risks.
“This perception highlights the need for regulators and organisations to strengthen transparency by publishing enforcement statistics, investigation outcomes and corrective measures, showing that complaints from ordinary Malaysians are also investigated and addressed with equal seriousness,” he stressed.
Malaysia has faced several major data security concerns in recent years. On Dec 4, 2024, an alleged leak involving 17 million MyKad records raised concerns over possible identity theft and financial fraud, prompting investigations into the authenticity and scale of the breach.
The incident followed previous data breach cases involving financial institutions and criminal syndicates that sold stolen personal information.
By May 8 this year, Malaysia was reported to be facing a growing cyber threat landscape, ranking fourth in Southeast Asia for dark web advertisements and sixth for cyberattacks, accounting for 10 per cent of regional cybersecurity threats.
Cybersecurity experts, including Positive Technologies chief hacking officer Dmitry Serebryannikov, highlighted that Malaysia’s high internet penetration had made it an attractive target for cybercriminals, stressing the need for stronger cybersecurity cooperation, improved protection measures and greater awareness to address vulnerabilities in the digital ecosystem.
As Malaysia’s digital economy expands, Murugason said the PDPA framework must continue evolving to address increasingly complex cybersecurity threats.
“Although the PDPA has provided Malaysia with an important legislative foundation for more than a decade, the framework requires comprehensive strengthening to meet the demands of an increasingly data-driven economy.
“Significant personal data breaches should be subject to mandatory, time-bound notification to both regulators and affected individuals.
“The legal framework should also impose clearer governance responsibilities on boards and senior management, strengthen accountability where negligence contributes to breaches and align Malaysia more closely with international best practices,” he emphasised.
Murugason added that individuals affected by possible data breaches should take immediate steps to protect themselves, including securing accounts, changing passwords, enabling multi-factor authentication, monitoring financial activity and preserving evidence related to suspected misuse.
He said complaints could also be submitted to the Department of Personal Data Protection, which has investigative and enforcement powers.
“Restoring public confidence will require not only legislative reform but also sustained public awareness, stronger collaboration between government and industry as well as closer alignment with Asean and global standards to create a resilient and trusted digital ecosystem rather than one that relies on reactive crisis management.
“Organisations should view personal data protection not merely as a legal obligation but as a core element of corporate governance and digital trust,” he said.
At the time of writing, Sinar Daily has reached out to MCMC for a response on the matter, but no reply has been received so far.