SOCSO

Summary

Perkeso confirmed a cyberattack on its systems, database, and website, stating that its ICT team activated a crisis management plan and regained control after attackers initially sought to paralyze daily operational infrastructure. A hacker group allegedly posted sample personal data including names, identification numbers, phone numbers, salaries, business names, and blood types, along with a recording of an internal video meeting that was later removed from YouTube. The organization described the leaked material as questionable, incomplete, and invalid, noting that some data had never existed in its records, while assuring contributors, employers, and the public that service delivery, interest payments, compensation, and disability pensions would continue uninterrupted. It also reported that attackers shifted to character assassination attempts after losing access and that forensic details were shared with relevant authorities following a prior contained breach.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Perkeso, Malaysia’s social security organisation, confirmed on December 8, 2023 that its systems, database and website had been subjected to a cyber attack beginning on Saturday, December 2, 2023. A hacker group had posted a forum thread alleging that Perkeso’s systems were compromised and shared sample data containing personal information including full names, IC numbers, phone numbers, salaries, business names and blood types. The group also shared a recording of Perkeso’s video meeting on the data breach, which was subsequently taken down from YouTube. Perkeso stated that the cyberattackers’ early modus operandi was to paralyse the infrastructure that handles daily operations. Once the cyberattack was confirmed on the same day, Perkeso activated a crisis management plan and mobilised its Information and communications technology team to restore its systems. The organisation assured that the planned attacks would not affect its ability to provide services to Socso contributors, employers and the public. After the ICT team regained control, the hackers switched tactics by launching character assassination attacks towards the organisation. Perkeso confirmed that all interest payments, compensation and disability pensions to contributors would be carried out based on the allocated duration.

Focusing on the supposed breached data, Perkeso said early observations revealed that the sample data was questionable, incomplete and not valid. The organisation explained that a cluster of the stolen data had never been recorded by Perkeso since its establishment in October 1971. Perkeso admitted that this was not the first time it had faced a cyberattack, noting that it had experienced a series of breaches previously, with the last incident occurring in September and being contained successfully. The organisation characterised the actions of the hackers as a targeted attack towards the country’s interest and stated that it had shared forensic details with the authorities to ensure that similar incidents do not happen to other government agencies. Personal information exposed in such breaches can be misused for fake registration, scams and phishing attacks, and once the data is out the damage is irreversible. The incident occurred amid several high-profile data breaches involving government apps, departments and agencies in recent years, including cases involving MySejahtera where over three million records were obtained and databases allegedly leaked from the National Registration Department and the Election Commission.

Sources

Sources available to members: 1 source.