Cyber Incident Victim: Prudential BSN Takaful Berhad
Date:
Jun 2023
Location:
Malaysia
Summary
Prudential BSN Takaful Berhad and its affiliate were impacted by a global MOVEit cyber attack exploiting a zero-day vulnerability, resulting in unauthorized access to agent and customer data likely including names, contact details, national identification numbers, bank account information, and partial credit card details. The companies promptly isolated affected servers, initiated investigations, notified authorities, and established dedicated support channels while confirming no operational disruptions occurred.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Prudential Assurance Malaysia Berhad (PAMB) and Prudential BSN Takaful Berhad (PruBSN) confirmed on or around June 13, 2023, that they were among numerous global organizations impacted by a cyberattack exploiting a zero-day vulnerability in the MOVEit file-transfer software. The companies detected unauthorized access to their systems through this vulnerability, which enabled data theft. Upon discovery, immediate containment measures were implemented, including isolation of the affected server to prevent further unauthorized access. Incident response teams initiated a thorough investigation to assess the scope and nature of the breach, while relevant Malaysian authorities were notified in compliance with regulatory obligations. Preliminary findings indicated that attackers likely exfiltrated personal data belonging to insurance agents and customers, though full confirmation of the compromised dataset required further forensic analysis. The companies emphasized that their core business operations remained unaffected, with no disruption to customer services or policy management systems.
The investigation revealed that exposed data likely included names, contact numbers, national identification numbers, bank account details, and partial credit card information. PruBSN and PAMB clarified that only fragments of credit card data were accessed, reducing but not eliminating risks of unauthorized financial transactions. Impacted individuals were to receive direct notifications, and both entities established dedicated customer hotlines with extended operating hours to address inquiries. As of June 27, 2023, forensic work continued to verify the exact data compromised and identify all affected parties. The companies reiterated their ongoing efforts to strengthen cybersecurity defenses, including regular system reviews and prompt patching of vulnerabilities. No evidence suggested operational systems beyond the MOVEit platform were breached, and no ransomware or disruptive payloads were deployed during the incident. Updates were published on corporate websites (prudential.com.my and prubsn.com.my) to maintain transparency throughout the response.