Malaysia telecommunications mega data breach

On 30 October 2017, Malaysian technology forum Lowyat.net revealed that the personal data of 46.2 million mobile subscribers was circulating for sale online — a figure exceeding Malaysia's entire population of roughly 32 million, because it included prepaid SIMs, inactive accounts, and subscribers holding multiple lines. It remains the largest data breach in Malaysian history.

What happened

In mid-October 2017, Lowyat.net received a tip that someone was attempting to sell several large databases of Malaysian personal information directly on its forums. After verifying the data, the site alerted the Malaysian Communications and Multimedia Commission (MCMC), which confirmed both the breach and the staggering 46.2 million figure within days.

The leaked records spanned at least a dozen operators and mobile virtual network operators (MVNOs), including Maxis, Celcom, DiGi, U Mobile, Altel, RedTone, TuneTalk, XOX, Enabling Asia, Friendimobile, MerchantTradeAsia and PLDT. The compromised fields were unusually rich for a telecom leak.

Data exposed

For each subscriber the data set included:

• Full name and billing/postal address
• Mobile telephone number
• SIM card and IMSI (International Mobile Subscriber Identity) numbers
• Handset model
• National ID card (MyKad) numbers

The combination of MyKad numbers, IMSI data and phone numbers made the trove especially dangerous, enabling SIM-swap fraud, identity theft and highly targeted scam campaigns.

Source and attribution

The origin was never conclusively established. Investigators noted the data appeared to date from around 2014, suggesting it may have been extracted from a historic regulatory data set or leaked by an insider with access to aggregated subscriber records. Some analysts characterised the incident as a likely inside job, given the breadth of operators involved and the centralised nature of the data. No threat actor was ever publicly identified or charged.

Impact and response

The breach exposed essentially every mobile-using Malaysian to elevated fraud risk. The MCMC and Royal Malaysia Police opened investigations, but as of parliamentary updates in March 2018, the probe remained open with no charges. The incident became a catalyst for debate over enforcement of Malaysia's Personal Data Protection Act 2010 (PDPA) — which at the time did not apply to federal and state government data — and over the security obligations of telecom operators.

Why it matters

The 2017 telco breach is Malaysia's defining privacy incident: a nationwide exposure of identity-grade data that touched nearly the whole population, yet produced no successful prosecution and no clear accountability. It exposed structural weaknesses in how Malaysian carriers and regulators stored and shared bulk subscriber data, and it drove subsequent reforms to strengthen the PDPA and breach-notification expectations across the sector.