Cyber Incident Victim: Suruhanjaya Pilihan Raya Malaysia
Date:
Apr 2022
Location:
Malaysia
Summary
A data breach allegedly compromised personal information of 800,000 voters from Malaysia's Election Commission database, with 67GB of data reportedly offered for sale on an online marketplace for $2,000. The incident drew official denial from authorities, who asserted the Commission only releases limited voter details like names and identity card numbers. This marked another in a series of prior voter data exposures involving the same entity, though the legitimacy and scope of the current breach remained disputed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In April 2022, a listing appeared on an online marketplace advertising the alleged sale of a 67GB dataset purportedly containing Malaysian voter information from the Election Commission (EC) database. The dataset, priced at US$2,000, was claimed to include personal details of approximately 800,000 voters. While the listing initially drew limited attention, broader public reporting emerged in November 2022 when Malaysian media outlets highlighted the listing’s existence and potential implications. The compromised data reportedly included voter names and identity card numbers, though the full scope of exposed information was not detailed in available reports. This incident followed earlier reports in 2021 of Malaysian voter data being leaked or sold, suggesting potential systemic vulnerabilities in the protection of electoral records.
Malaysian authorities responded to the November 2022 reports with a denial of the breach claims. The Home Minister stated that the Election Commission only releases basic voter information such as names and identity card numbers, implying the data in question might not represent a novel breach of EC systems. No additional technical details about the breach methodology, evidence of data exfiltration, or confirmation of the dataset’s authenticity were disclosed by officials. The incident raised public concerns about the security of voter registration systems and the potential misuse of personal data for fraud or targeted disinformation. Despite official reassurances, the listing’s persistence and historical precedents of electoral data exposure underscored ongoing challenges in safeguarding sensitive voter information in Malaysia’s digital infrastructure.