Website sells personal information for as low as RM5
A more concerning revelation was the exposure of data on the three-digit card verification value (CVV) on the back of debit or credit cards.
SHAH ALAM – A Facebook post alleging a major data leak on the website Caghi.com has been verified, with personal and confidential information, including banking details and business records, found to be publicly accessible.
The claims, made by a user with the account name Pendakwah Teknologi, were investigated by Sinar journalists, who confirmed that sensitive information such as home addresses, voter registration records, and education loan details were available on the site.
A more concerning revelation was the exposure of data on the three-digit card verification value (CVV) on the back of debit or credit cards.
The website also suggested neighbouring home addresses, complete with their identity card numbers and full names, for any given address search.
The website’s display indicated that the data was sourced from government departments, including the National Registration Department (NRD), Road Transport Department (RTD) and the MySPR Semak application, as well as several utility and telecommunications companies.
This finding suggested that anyone could access personal details if they possessed an individual’s identity card number and were willing to pay.
Checks also found that the personal information could be accessed without a virtual private network (VPN), with regular search engines such as Google Chrome being sufficient.
The site offered a pricing structure for greater access, ranging from about RM5 to a maximum of RM245.
Inactive user accounts on Caghi.com would be permanently deleted if they did not subscribe to a product within five days, although a lifetime activation was available for a one-time fee of RM25.
Sinar sought a response from Communications Minister Datuk Fahmi Fadzil, the Malaysian Communications and Multimedia Commission (MCMC) and the Department of Personal Data Protection (JPDP) for clarification, as this unauthorised website clearly violated cyber laws, including the Personal Data Protection Act 2010 (Act 709).
Download Sinar Daily application.Click Here!
