Malaysia is facing national crisis over data leaks

PUTRAJAYA – Malaysia is currently facing an increasingly severe and devastating data leakage crisis that can now be regarded as a national crisis.

Senior researcher at Universiti Tun Hussein Onn Malaysia's Centre for Cybersecurity and Data Intelligence Associate Professor Dr Zubaile Abdullah said the recent rising trend in data breach incidents shows that the issue is no longer an isolated case.

Instead, he said it demands immediate and comprehensive action from the government, enforcement agencies and data-handling organisations.

"We are indeed facing a serious and systemic data leak crisis. In fact, it can be described as a national crisis due to the rising trend," he told Sinar.

Data security has returned to the spotlight following allegations of personal data leaks involving influencer and entrepreneur Khairul Aming, sparking public concern over the level of personal data protection in the country.

Commenting on the causes, Zubaile said while the public is becoming more aware of cyber threats, threat actors are now using increasingly cunning social engineering tactics to deceive victims.

He explained that threat actors exploit emotions such as fear, panic, trust and urgency, causing individuals to unwittingly hand over their personal information.

"If we look at previous reports, victims are not just members of the general public, but also include highly educated individuals," he said.

He added that weak organisational security systems remain a major factor. Outdated systems, poor access controls, compromised passwords and insufficient security configurations create easy entry points for intrusion attacks.

"System intrusion attacks are among the primary causes of data breaches," he said.

At the same time, Zubaile did not rule out the possibility of insider threats, individuals entrusted with data management who intentionally leak information to third parties.

According to him, there are cases where certain individuals disclose data after being offered financial rewards. This data is then weaponised to launch further cybercrimes, including online scams.

"A data leak rarely stops at just the exposed data itself; it often serves as the starting point for various other profitable cyberattacks," he cautioned.

Addressing immediate measures, Zubaile emphasised that the government must focus simultaneously on three main aspects which are enforcement, prevention, and raising public awareness.

He said a reactive approach, waiting for a leak to occur before taking action is no longer viable in today's cyber threat landscape.

He proposed that the Personal Data Protection Department prioritise auditing companies and organisations that handle large volumes of data or sensitive information.

Furthermore, he argued that organisations should be mandated to report data breach incidents and notify affected individuals within a reasonable timeframe.

This would allow victims to take protective measures, such as changing passwords, tightening account security and staying vigilant against follow-up scam attempts.

Tougher action should also be taken against organisations that fail to implement reasonable security controls, he noted.

"A clear distinction must be made between organisations that implemented security controls but still fell victim to an attack and those that outright neglected data security and lacked a culture of security awareness among staff," he said.

He added that organisations cannot shirk their responsibility for data security even if processing is outsourced to third-party vendors or service providers.

To ensure systematic security practices, Zubaile suggested the government consider requiring vendors or organisations handling sensitive data to comply with established information security standards, such as ISO/IEC 27001.

Finally, he stressed that public awareness campaigns must be continuously strengthened and rendered more practical, focusing on identifying phishing attempts, scam calls, fake links, secure password management and the real-world impact of data leaks on people's lives.