Cyber Incident Victim: Telekom Malaysia
Date:
Dec 2022
Location:
Malaysia
Summary
A data breach at Telekom Malaysia impacted 250,248 Unifi Mobile customers, exposing names, phone numbers, and email addresses, though the company asserted no additional information was compromised. The incident was contained with affected users notified and no service disruptions reported, while a third-party seller separately advertised purported records of over 2.7 million entries—including payment details and transaction IDs—though TM maintained only limited data was accessed. The company engaged national cybersecurity and data protection authorities to address the breach and advised customers to exercise caution with unsolicited communications.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Telekom Malaysia (TM) confirmed a data breach affecting its Unifi Mobile service on December 28, 2022, impacting 250,284 individual and small-to-medium enterprise (SME) customer accounts. The company stated investigations revealed unauthorized access to customer names, phone numbers, and email addresses, asserting no other data was compromised. TM claimed the breach had been contained by the disclosure date, with measures implemented to minimize impact on affected customers, all of whom were notified directly. Service operations for Unifi Mobile users remained uninterrupted throughout the incident. The breach gained public attention on December 30 when intrusion analyst Adnan Mohd Shukor tweeted about the exposed database, though he subsequently deleted the post citing an "official request" for removal.
The compromised data appeared for sale on a data breach forum on December 24, four days prior to TM's official confirmation. The seller advertised over 2.7 million records priced at US$850 (RM3,750), offering "admin access" without elaboration and promising exclusivity through a single-copy sale. A 100-entry sample provided by the seller contradicted TM's claims about limited data exposure, revealing additional compromised fields: payment methods, transaction amounts, transaction IDs, and receipt numbers. TM engaged regulatory authorities following the breach, reporting incidents to Malaysia's National Cyber Coordination and Command Centre (NC4), Department of Privacy and Data Protection (JPDP), and Malaysian Communications and Multimedia Commission (MCMC). The company maintained continuous monitoring of systems and advised customers to exercise caution with unsolicited communications while reinforcing personal cybersecurity practices.