'No way' to stop sale of 46 million Malaysians' personal data after crippling breach
Two weeks ago news broke of a major data breach that affected 46 million Malaysian mobile phone users and many telecommunications providers in 2014.
New findings from Quann Malaysia say that the data involved in the breach is for sale for RM32,000 (around 1.16 Bitcoin at time of publication) and there is 'no way' to stop the data from being sold.
According to Quann Malaysia general manager Ivan Wen, customers who have not changed their SIM cards since 2014 should do so as soon as possible.
"Perhaps telecommunication companies should ensure these customers are able to change their SIM cards free of charge to encourage quicker resolution to this massive data breach incident," he says.
The leaked data includes postpaid and prepaid numbers, customer details, addresses as well as sim card information – including unique IMEI and IMSI numbers. Cyber criminals may use that information to conduct social engineering attacks or phone cloning.
Wen says it is almost impossible to stop the sales unless the affected companies pay a ransom to the data thief.
"However, paying a ransom does not guarantee that the data will not be leaked. As such, we do not encourage companies to do so. This extremely attractive pricing for so much data will lead to a rise in the number of buyers who are confident they cannot be tracked," he explains.
While Quann Malaysia says it is unclear if attackers have demanded a ransom from telecommunications providers, the Bitcoin blockchain means that any company or person can buy the entire list of data from the criminal.
Bitcoin processes also mean that the identities of both buyer and seller remain anonymous. Wen says that few countries have implemented proper Know-Your-Customer regulations around Bitcoin purchases.
"It is high time that we take a different approach to dealing with the spiralling number of worldwide ransomware demands," he explains.
We hope that regulators and policy makers will take action to put in more defined processes and regulations, for example in the upcoming Cyber Security law, to track the purchase and dealings in Bitcoin among Malaysians, so that fraudulent (data) purchases can be tracked.
"Individuals or companies found purchasing these leaked data, should be penalised. Only when the buying stops, then only will the hacking stop as there are no more buyers to fund these hackers.
Wen calls on the likes of Bank Negara, which will able to stop the fraudulent purchase of the compromised data.
"The Malaysian Communications and Multimedia Commission (MCMC) is most well equipped to aid Bank Negara in drafting air tight regulations to stop fraudulent buying.
