Certain information cannot be easily changed, so criminals can reuse them repeatedly for scams and phishing: Specialist
PETALING JAYA: IT experts have said personal data leaks in Malaysia may be more widespread and longer-lasting than official figures suggest, following the Digital Ministry’s written parliamentary reply on Monday on recorded breach cases.
Universiti Malaysia Pahang Al-Sultan Abdullah Computer Network and Cyber Security Department head Dr Syifak Izhar Hisham said the 535 recorded data breach cases under the Digital Ministry since 2022 do not reflect the true scale of intrusions.
“Logically, the real number is higher than what is reported or detected. This happens everywhere, not only in Malaysia.
“Leakage issues go undetected because of ‘Advanced Persistent Threats’, in which attackers are already inside the victim’s network by the time they are discovered.
“Shadow IT, such as unmonitored browser usage, means organisations do not have full visibility over all their data assets. Attackers also carry out silent theft, in which they do not damage systems but quietly copy data.”
She said statistics could understate the severity of exposure.
“Usually, one major incident is counted as one case, but it can involve millions of data records. If you look at the dark web, a large amount of data is being leaked, but the number of cases does not reflect how critical the situation is.
“When personal data is stolen, it is copied, stored and circulated within hacker communities. Information such as IC numbers and dates of birth cannot be easily changed, so criminals can reuse them repeatedly for scams, phishing and identity impersonation even years after the original breach,” she added.
Universiti Teknologi Mara Institute for Big Data Analytics and AI director Prof Dr Jasni Mohamad Zain said the long-term danger lies in how leaked data is analysed and reused.
“Seemingly innocuous attributes, such as an email or postcode, could act as linking keys. Multiple partial datasets could be merged to form rich, detailed personal profiles.
“Each additional dataset enhances feature richness, predictive accuracy and contextual understanding of the individual. In effect, personal data behaves like a persistent digital footprint, not a consumable asset.”
She said the impact of a breach does not end once accounts are secured.
“From a data science perspective, data leaks are difficult to reverse because data replication is irreversible once it propagates beyond the original system. Even after users change passwords or phone numbers, leaked data could support identity-verification bypasses and long-term profiling.”
Universiti Tun Hussein Onn Malaysia IT security system specialist Dr Zubaile Abdullah said the 535 cases recorded should not be seen as a full picture of the country’s data security posture.
“Many data breaches take place quietly, whether through undetected account compromises, intrusions that are only discovered after the data has been sold, or leaks originating from third parties, such as vendors and service providers.”
On why some incidents go unreported, he pointed to reputational fears and limited detection capabilities.
“There is often a perception that public disclosure will cause more harm than the breach itself. Some organisations simply do not realise that a breach has occurred or they underestimate its severity.
“Breaches are treated as operational or technical issues to be resolved quietly. This ‘manage it internally’ approach is often driven by fear of scrutiny, uncertainty over reporting thresholds or a belief that the incident can be controlled without external involvement.”
In a written Parliament reply to Datuk Seri Dr Ronald Kiandee (PN-Beluran), the Digital Ministry disclosed that 535 personal data breach cases were recorded between 2022 and 2025, with 314 under the Personal Data Protection Act 2010 and 221 outside its scope.
The ministry said amendments to the Act now require organisations to appoint Data Protection Officers, notify regulators and affected individuals of breaches, and face higher penalties of up to RM1 million or imprisonment for non-compliance.
