Social Security Organisation

Summary

Malaysia’s social security organisation confirmed a cyber attack on its systems, database, and website after a hacker group posted alleged compromised data and a meeting recording online. The organisation activated a crisis management plan and its ICT team regained control of infrastructure that had been targeted to disrupt daily operations, after which the attackers shifted to character assassination efforts. It stated that the leaked sample data was questionable, incomplete, and included records never held by the organisation, while contributor payments and pensions would continue on schedule. A prior breach had previously been contained, and forensic details were shared with authorities.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Perkeso, Malaysia's social security organisation, confirmed that a cyber attack targeted its systems, database, and website beginning on Saturday, December 2, 2023. A hacker group posted a forum thread alleging that Perkeso's systems had been compromised and shared sample data containing personal information such as full names, IC numbers, phone numbers, salaries, business names, and blood types. The group additionally published a recording of a Perkeso video meeting concerning the data breach, though that recording was subsequently removed from YouTube. Once the cyberattack was confirmed, Perkeso activated a crisis management plan and mobilised its information and communications technology team to restore its systems. The attackers initially sought to paralyse the infrastructure responsible for daily operations. After Perkeso's ICT team regained control, the hackers changed tactics by launching character assassination attacks against the organisation. Perkeso noted that this was not its first encounter with a cyber incident, referencing a prior breach in September that had been contained successfully. The organisation maintained that the planned attacks would not disrupt its capacity to serve contributors, employers, and the public. It also confirmed that interest payments, compensation, and disability pensions would continue according to the allocated duration.

Regarding the compromised data, Perkeso stated that early observations showed the supposed sample data was questionable, incomplete, and not valid, and that a cluster of the stolen data had never been recorded by the organisation since its establishment in October 1971. Perkeso characterised the incident as a targeted attack against the country's interest and shared forensic details with authorities to help prevent similar occurrences at other government agencies. The article situates the event within a broader pattern of high-profile breaches affecting government apps, departments, and agencies in recent years, including MySejahtera, where over three million records were obtained, and alleged database leaks from the National Registration Department and the Election Commission. Exposed personal information can be misused for fake registration, scams, and phishing attacks, and the damage becomes irreversible once the data is released. Legal experts have urged the government to amend the Personal Data Protection Act so that government agencies can be held accountable for data breaches, noting that the current law applies only to commercial entities and transactions and exempts both federal and state governments.

Sources

Sources available to members: 1 source.