Story image

'No way' to stop sale of 46 million Malaysians' personal data after crippling breach

14 Nov 2017

Two weeks ago news broke of a major data breach that affected 46 million Malaysian mobile phone users and many telecommunications providers in 2014.

New findings from Quann Malaysia say that the data involved in the breach is for sale for RM32,000 (around 1.16 Bitcoin at time of publication) and there is 'no way' to stop the data from being sold.

According to Quann Malaysia general manager Ivan Wen, customers who have not changed their SIM cards since 2014 should do so as soon as possible.

“Perhaps telecommunication companies should ensure these customers are able to change their SIM cards free of charge to encourage quicker resolution to this massive data breach incident,” he says.

The leaked data includes postpaid and prepaid numbers, customer details, addresses as well as sim card information – including unique IMEI and IMSI numbers. Cyber criminals may use that information to conduct social engineering attacks or phone cloning.

Wen says it is almost impossible to stop the sales unless the affected companies pay a ransom to the data thief.

“However, paying a ransom does not guarantee that the data will not be leaked. As such, we do not encourage companies to do so. This extremely attractive pricing for so much data will lead to a rise in the number of buyers who are confident they cannot be tracked,” he explains.

While Quann Malaysia says it is unclear if attackers have demanded a ransom from telecommunications providers, the Bitcoin blockchain means that any company or person can buy the entire list of data from the criminal.

Bitcoin processes also mean that the identities of both buyer and seller remain anonymous. Wen says that few countries have implemented proper Know-Your-Customer regulations around Bitcoin purchases.

“It is high time that we take a different approach to dealing with the spiralling number of worldwide ransomware demands,” he explains.

We hope that regulators and policy makers will take action to put in more defined processes and regulations, for example in the upcoming Cyber Security law, to track the purchase and dealings in Bitcoin among Malaysians, so that fraudulent (data) purchases can be tracked.”

“Individuals or companies found purchasing these leaked data, should be penalised. Only when the buying stops, then only will the hacking stop as there are no more buyers to fund these hackers.”

Wen calls on the likes of Bank Negara, which will able to stop the fraudulent purchase of the compromised data.

 “The Malaysian Communications and Multimedia Commission (MCMC) is most well equipped to aid Bank Negara in drafting air tight regulations to stop fraudulent buying.”

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.