Cyber Incident Victim: National Registration Department
Date:
May 2022
Location:
Malaysia
Summary
A large-scale data breach allegedly exposed personal information of 22.5 million Malaysians, including national identity numbers, birth dates, addresses, gender, religion, and official photographs, with the dataset reportedly sold on the dark web. Malaysian authorities denied the leak originated from the National Registration Department, citing internal security mechanisms, though this followed a similar prior incident involving millions of records from the same department. Cybersecurity experts warned the compromised data could facilitate identity fraud, such as unauthorized financial transactions, while highlighting common challenges in breach detection, including organizations often learning of leaks through external reports. The government faced public scrutiny over perceived insufficient urgency in addressing recurring cybersecurity vulnerabilities within its agencies.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In May 2022, reports emerged of an alleged data leak involving the personal information of 22.5 million Malaysians, attributed to the National Registration Department (NRD). A database approximately 160GB in size, containing records of individuals born between 1940 and 2004, was offered for sale on the dark web for US$10,000. The dataset reportedly included national identity numbers, dates of birth, addresses, gender, religion, and official identification photographs. This incident followed a similar breach in 2021, where data of approximately 4 million Malaysians from the NRD appeared on dark web forums. Malaysian authorities, including the Home Minister, disputed the origin of the leaked data, asserting that NRD security mechanisms indicated the information did not originate from their systems. Investigations into the breach were initiated, though no conclusive findings regarding the source or method of exfiltration were disclosed at the time of reporting.
The incident generated significant public concern regarding cybersecurity practices within Malaysian government agencies, particularly due to recurring data exposures. Potential impacts included risks of identity fraud, with criminal groups potentially exploiting the leaked information for financial crimes such as unauthorized loans or credit applications. No confirmed instances of misuse were reported in immediate connection with the breach. The government maintained that the situation was under control but provided no specific remediation measures or technical details about containment efforts. Public statements focused on downplaying the severity while acknowledging ongoing probes, leaving many citizens apprehensive about data protection standards. The lack of transparency about the breach's origin and the absence of concrete corrective actions underscored broader anxieties about institutional cyber resilience in handling sensitive citizen data.