Story image

'No way' to stop sale of 46 million Malaysians' personal data after crippling breach

14 Nov 17

Two weeks ago news broke of a major data breach that affected 46 million Malaysian mobile phone users and many telecommunications providers in 2014.

New findings from Quann Malaysia say that the data involved in the breach is for sale for RM32,000 (around 1.16 Bitcoin at time of publication) and there is 'no way' to stop the data from being sold.

According to Quann Malaysia general manager Ivan Wen, customers who have not changed their SIM cards since 2014 should do so as soon as possible.

“Perhaps telecommunication companies should ensure these customers are able to change their SIM cards free of charge to encourage quicker resolution to this massive data breach incident,” he says.

The leaked data includes postpaid and prepaid numbers, customer details, addresses as well as sim card information – including unique IMEI and IMSI numbers. Cyber criminals may use that information to conduct social engineering attacks or phone cloning.

Wen says it is almost impossible to stop the sales unless the affected companies pay a ransom to the data thief.

“However, paying a ransom does not guarantee that the data will not be leaked. As such, we do not encourage companies to do so. This extremely attractive pricing for so much data will lead to a rise in the number of buyers who are confident they cannot be tracked,” he explains.

While Quann Malaysia says it is unclear if attackers have demanded a ransom from telecommunications providers, the Bitcoin blockchain means that any company or person can buy the entire list of data from the criminal.

Bitcoin processes also mean that the identities of both buyer and seller remain anonymous. Wen says that few countries have implemented proper Know-Your-Customer regulations around Bitcoin purchases.

“It is high time that we take a different approach to dealing with the spiralling number of worldwide ransomware demands,” he explains.

We hope that regulators and policy makers will take action to put in more defined processes and regulations, for example in the upcoming Cyber Security law, to track the purchase and dealings in Bitcoin among Malaysians, so that fraudulent (data) purchases can be tracked.”

“Individuals or companies found purchasing these leaked data, should be penalised. Only when the buying stops, then only will the hacking stop as there are no more buyers to fund these hackers.”

Wen calls on the likes of Bank Negara, which will able to stop the fraudulent purchase of the compromised data.

 “The Malaysian Communications and Multimedia Commission (MCMC) is most well equipped to aid Bank Negara in drafting air tight regulations to stop fraudulent buying.”

Twitter suspects state-sponsored ties to support forum breach
One of Twitter’s support forums was hit by a data breach that may have ties to a state-sponsored attack, however users' personal data was exposed.
How McAfee aims to curb enterprise data loss
McAfee DLP aims to help safeguard intellectual property and ensure compliance by protecting sensitive data.
2018 sees 1,500% increase in coinmining malware - report
This issue will only continue to grow as IoT forms the foundation of connected devices and smart city grids.
2019 threat landscape predictions - Proofpoint
Proofpoint researchers have looked ahead at the trends and events likely to shape the threat landscape in the year to come.
Mac malware on WatchGuard’s top ten list for first time
The report is based on data from active WatchGuard Firebox unified threat management appliances and covers the major malware campaigns.
Bin 'em: Those bomb threat emails are complete hoaxes
A worldwide spate of spam emails claiming there is a bomb in the recipient’s building is almost certainly a hoax.
Marriott sets up call centres to answer questions on data breach
Marriott has released an update on the breach of the Starwood guest reservation data breach which affected 500 million guests.
Why there will be a battle for the cloud in 2019
Cloud providers such as AWS, Azure, and Google will likely find themselves in a mad scramble to gain additional enterprise customers.