Story image

'No way' to stop sale of 46 million Malaysians' personal data after crippling breach

14 Nov 2017

Two weeks ago news broke of a major data breach that affected 46 million Malaysian mobile phone users and many telecommunications providers in 2014.

New findings from Quann Malaysia say that the data involved in the breach is for sale for RM32,000 (around 1.16 Bitcoin at time of publication) and there is 'no way' to stop the data from being sold.

According to Quann Malaysia general manager Ivan Wen, customers who have not changed their SIM cards since 2014 should do so as soon as possible.

“Perhaps telecommunication companies should ensure these customers are able to change their SIM cards free of charge to encourage quicker resolution to this massive data breach incident,” he says.

The leaked data includes postpaid and prepaid numbers, customer details, addresses as well as sim card information – including unique IMEI and IMSI numbers. Cyber criminals may use that information to conduct social engineering attacks or phone cloning.

Wen says it is almost impossible to stop the sales unless the affected companies pay a ransom to the data thief.

“However, paying a ransom does not guarantee that the data will not be leaked. As such, we do not encourage companies to do so. This extremely attractive pricing for so much data will lead to a rise in the number of buyers who are confident they cannot be tracked,” he explains.

While Quann Malaysia says it is unclear if attackers have demanded a ransom from telecommunications providers, the Bitcoin blockchain means that any company or person can buy the entire list of data from the criminal.

Bitcoin processes also mean that the identities of both buyer and seller remain anonymous. Wen says that few countries have implemented proper Know-Your-Customer regulations around Bitcoin purchases.

“It is high time that we take a different approach to dealing with the spiralling number of worldwide ransomware demands,” he explains.

We hope that regulators and policy makers will take action to put in more defined processes and regulations, for example in the upcoming Cyber Security law, to track the purchase and dealings in Bitcoin among Malaysians, so that fraudulent (data) purchases can be tracked.”

“Individuals or companies found purchasing these leaked data, should be penalised. Only when the buying stops, then only will the hacking stop as there are no more buyers to fund these hackers.”

Wen calls on the likes of Bank Negara, which will able to stop the fraudulent purchase of the compromised data.

 “The Malaysian Communications and Multimedia Commission (MCMC) is most well equipped to aid Bank Negara in drafting air tight regulations to stop fraudulent buying.”

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Ensign and IronNet partner to create cyber analytics capabilities
The Singapore-based joint venture will form a Cyber Analytics Center for Excellence focused on securing regional enterprises from sophisticated cyber threats.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.