POLICE have recorded statements from witnesses to assist the investigation into recent data breaches, said the deputy communications and multimedia minister.

Jailani Johari (BN-Hulu Terengganu) said several authorities and agencies, including the Malaysian Communications and Multimedia Commission (MCMC), Department of Personal Data Protection (JPDP), Attorney-General’s Chambers (AGC), and the National Cyber Security Agency (Nacsa), were still investigating the matter.

“Investigations into the cases are ongoing. Identified witnesses have been called in by police to record their statements to assist in the investigations.

“Once the investigations are complete, the investigation papers will be submitted to AGC for further action,” he told the Dewan Rakyat today.

He said the investigations were carried out under Section 4 of the Computer Crimes Act 1997 (CCA) and Section 130 of the Personal Data Protection Act 2010.

Jailani was responding to a question by Teo Nie Ching (DAP-Kulai), who asked the ministry to state the action taken against the parties involved in the personal data breach that had affected 46.2 million mobile phone subscribers in the country.

Malaysians first heard of a massive data breach on October 19 last year, when online forum Lowyat.net reported that the data of 46.2 million mobile phone subscribers had been leaked.

The breach was said to have happened in 2012 to 2015, affecting Jobstreet.com, Malaysian Medical Association, Malaysian Medical Council, Academy of Medicine Malaysia, Malaysian Dental Association, National Specialist Register of Malaysia, and telecommunication companies including Maxis, Celcom and DiGi.

MCMC had ordered the online forum to remove news on the data breach.

Police traced the leak to an IP address in Oman, and said the breach could have taken place during a data transaction and could have involved employees of a company.

Lowyat also raised an alert on another data breach, involving 220,000 Malaysian organ donors registered with government hospitals and transplant centres.

The data was leaked online as early as September 2016, and contained personal information on the donors’ next of kin. – March 14, 2018.