Cyber Security
The Malaysian Personal-Data Lookup Case: What the June 2026 Claims Establish—and What They Do Not
A viral June 2026 Threads post renewed concern over a searchable site displaying Malaysians’ personal information. EXEPERT checks the official record, separates confirmed incidents from allegations, and explains what DNS blocking can—and cannot—solve.
EXEPERT Editorial · 30 September 2026 MYT
Editorial and privacy note
This report reviews a public Threads post and the official statements and incident records connected to the discussion. EXEPERT did not access the alleged lookup service, purchase data, download records, or host the supplied screenshots. The optional Meta-hosted Threads embed may show media from the original post. No personal-record details are transcribed in this report.
The case in brief
A public Threads post by @belumsetel on 19 June 2026 renewed concern about a searchable site that appeared to display Malaysians’ personal information. The post questioned how data belonging to citizens and public figures could be exposed online and whether blocking the site through DNS could solve the problem. Original Threads post
The post is a legitimate source for understanding what was being discussed publicly. It is not, by itself, forensic proof of where the records came from, when they were collected, or whether a government system was breached.
The strongest conclusion supported by the public record is narrower: authorities have been responding to the circulation of personal data for several years, and the material discussed in June 2026 was described by JPN and NACSA as connected to older incidents. The public record does not establish that every record shown by the site came directly from JPN, that the information was newly stolen in June 2026, or that every displayed record was accurate.
What the official record says
Jabatan Pendaftaran Negara (JPN) denied that its core systems had been compromised. JPN said the viral claims recycled incidents handled in 2021 and 2022 involving an external agency that stored data shared for service delivery. It said police and MCMC reports had been made and that data-sharing controls had been strengthened. JPN statement reported by Sinar Harian
The National Security Council, through the National Cyber Security Agency (NACSA), later said the circulating information was believed to have been obtained unlawfully through intrusions into different systems before 2022 and was being redistributed through online platforms. NACSA said it was working with MyNIC, the Personal Data Protection Department and police on blocking, removal and digital-forensic work. Bernama report of the MKN/NACSA statement
The government had already confirmed that MCMC blocked caghi[.]com in June 2022. In September 2025, the communications minister also said the government did not have confirmation of the status of the data allegedly held by the site. RTM report
These statements establish that authorities had been responding to a personal-data distribution problem for several years. They do not publicly establish a record-by-record source, a current compromise of JPN's core systems, or a complete victim count.
Timeline: 2021 to 2026
Date | Publicly documented development | Status |
|---|---|---|
September 2021 | Police opened an investigation into an alleged sale of data relating to nearly four million Malaysians. The report said NRD and IRB systems would be examined; IRB denied an internal breach. SoyaCincau | Allegation investigated; source unresolved |
May 2022 | The Home Minister said an alleged 22.5-million-record dataset was not directly from NRD and was believed to be compiled from other sources and agencies with access. Bernama | Official denial of direct NRD origin |
June 2022 | MCMC blocked caghi[.]com, according to the communications minister's later confirmation. RTM | Confirmed access-blocking action |
November 2022 | The Election Commission denied an alleged leak involving 800,000 voters and said it was working with NACSA to investigate. Sinar Daily | Allegation investigated; no public confirmation of a successful EC breach |
December 2022 | TM confirmed that 250,248 Unifi Mobile customers were affected by a breach involving names, phone numbers and email addresses. TM statement | Confirmed incident |
February 2024 | MyCERT documented a R00TK1T campaign involving Malaysia-related postings and incidents affecting multiple organisations. MyCERT advisory | Confirmed campaign activity; individual claims require separate verification |
October 2024 | Police announced arrests connected to a syndicate accused of stealing and selling Malaysian personal data through a portal called Query Smart Search. Police referred to 400 million records, which is not the same as 400 million unique people. Bernama | Police allegation and investigation |
1 June 2025 | Sections of the Personal Data Protection (Amendment) Act 2024 came into force, including provisions connected to data-breach notification. Federal Gazette | Legal commencement date, not a breach |
September 2025 | The communications minister confirmed the MCMC block and said the status of data held by the site had not been confirmed. RTM | Confirmed government statement |
October 2025 | The government said JPDP and MCMC were working with hosting providers, CDNs and registrars to block and remove the site. New Straits Times | Confirmed government action |
19 June 2026 | The @belumsetel Threads post renewed public attention to the issue. Original Threads post | Public claim and source material |
20 June 2026 | JPN denied compromise of its core systems and said the claims referred to older incidents involving an external agency. Sinar Harian | Official denial |
21 June 2026 | MKN/NACSA said the data was believed to originate from intrusions before 2022 and was being redistributed. Bernama | Official explanation; forensic details remain unpublished |
Q2 2026 | CyberSecurity Malaysia recorded 175 data-breach incidents handled by Cyber999, compared with 124 in Q1. Its report warns that some purported new breaches were actually older datasets being recirculated. CyberSecurity Malaysia | Incident-report statistics, not proof of this case's victim count |
What DNS blocking can and cannot do
DNS blocking can stop users of a particular resolver or network from resolving a domain normally. It can reduce casual access and make a site harder to reach through participating networks.
It does not delete copied databases, identify the original source, notify affected people, or stop the same information from appearing under another domain. The Internet Corporation for Assigned Names and Numbers (ICANN) says DNS blocking is not completely effective in every context and may be circumvented. ICANN SAC127
Cloudflare's public resolver documentation also explains that its standard 1.1.1.1 resolver does not filter content. The technical point is that blocking works only where the relevant network or resolver enforces it. Cloudflare documentation
The broader response must include domain and hosting action, evidence preservation, forensic investigation, affected-organisation notifications, account protection and removal of unlawful copies. DNS blocking is one containment measure within that response.
Fact-check of the supplied 15-claim timeline
The supplied chronology should not be published as a factual breach list. It combines confirmed incidents, allegations, imprecise counts and events that were not breaches.
No. | Screenshot claim | Finding |
|---|---|---|
1 | 2014 telco leak: 46.2 million records | Partly supported, but the date and count need qualification. The live 2017 police/news report referred to 46.2 million mobile-subscriber records and separately described an offer to sell 50 million telecommunications records. Neither figure proves the number of unique people affected; the material may have included inactive numbers and multiple numbers per person. Malaysiakini/Bernama report |
2 | 2017 medical registers: 20,000 practitioners | Mismatched and unsupported as written. A contemporaneous report referred to 81,309 professional records, while the Malaysian Dental Association confirmed a possible attack involving older database information. A separate 2019 incident involved 19,922 exposed patient records; it was not a 2017 practitioner-register breach. MDA statement, 2017 report, 2019 patient-record report |
3 | Astro customer leak: 60,000 | Partly supported. Reports in 2018 referred to data from up to 60,000 IPTV customers. Astro acknowledged an alleged unauthorised sharing incident but said its investigation had not found confidential customer information in its custody to be compromised. The screenshot's exact field list should not be presented as established fact. Astro statement, contemporaneous report |
4 | Malaysia Airlines Enrich incident: 2019 | Confirmed third-party exposure, but the year is misleading. The exposed data covered March 2010 to June 2019 and was disclosed in March 2021. The affected fields included names, contact information, birth dates, gender, frequent-flyer numbers and tier levels. No card, itinerary, ID-card or payment information was reported in the notification. Incident report |
5 | JPN Series 1, 2021: four million citizens | Alleged and unresolved. Police investigated an alleged sale of nearly four million records and examined the possible NRD/IRB connection. IRB denied an internal breach. No public finding reviewed here confirms that the dataset came from JPN or represented four million unique citizens. SoyaCincau |
6 | JPN Series 2 and “SPRM” leak, 2022: 22.5 million plus 800,000 voters | Two allegations have been conflated, and the acronym is wrong. The 22.5-million claim was rejected as a direct NRD leak by the Home Minister. The 800,000-person allegation concerned the Election Commission, or SPR, not SPRM. The EC denied a system intrusion and said NACSA was investigating. Fingerprint exposure and a confirmed EC breach were not established in the reviewed sources. Bernama, Sinar Daily |
7 | Carousell Malaysia leak: 2.6 million users | Confirmed incident, but the description is inaccurate. Singapore's PDPC confirmed an incident involving a forum listing of data relating to approximately 2.6 million Carousell users. Carousell estimated that up to 3.389 million people might have been affected. The users were global, not Malaysia-only, and the regulator's decision does not support the screenshot's claim that passwords were lost. PDPC decision |
8 | Telekom Malaysia and Unifi Mobile: 250,000 | Confirmed with a precise figure. TM identified 250,248 affected customers and said the exposed information consisted of names, phone numbers and email addresses. TM statement |
9 | i-Saraan EPF leak claim, 2023 | Unverified. No reliable source reviewed confirms the specific i-Saraan breach, victim count or field list in the screenshot. It should not be published without primary evidence from EPF or an investigating authority. |
10 | R00TK1T campaign, 2024 | Partly supported. MyCERT identified 34 Malaysia-related postings and 16 incidents involving 13 organisations. It also observed infostealer credentials being used in attacks. That does not prove the screenshot's particular list of staff emails, credentials and vendor contracts was lost in one event. MyCERT advisory |
11 | PADU verification scrutiny, 2024 | Misleading and unresolved. A claim associated files labelled “PADU” with the federal PADU system. Government clarification said the reference was to an LPPKN management and service-delivery unit and denied a federal PADU breach. No reviewed public source confirms that active session IDs were intercepted. Economy Ministry material |
12 | Defence and military personnel leak, 2024: 14,000 people | Unverified. No public official confirmation for this specific 2024, 14,000-person claim was located. Separate reports about military information in 2025 and 2026 should not be backdated or merged into this claim. 2025 report, 2026 report |
13 | Corporate breach surge, 2025 | The trend is supported; the screenshot's single-event description is not. CyberSecurity Malaysia recorded 195 data-breach reports handled by Cyber999 in Q1 2025, compared with 151 in Q4 2024. These are incident reports, not unique victims. The report does not establish a single event involving millions of customers, Active Directory credentials, financial sheets and invoices. CyberSecurity Malaysia Q1 report |
14 | AI-driven corporate fraud, 2025 | The threat is real, but the data-loss claim is unsupported. A Securities Commission warning dated 22 July 2024 documented AI-generated deepfake scams that impersonated public figures and companies, collected personal information and directed victims toward downloads or money transfers. That warning predates the claimed 2025 event and does not confirm a corporate breach. No reviewed source confirms one corporate event involving stolen voice biometrics, face scans, executive identities and wire codes. Securities Commission warning |
15 | Mandatory DBN enforcement, 2026 | Misclassified. Data-breach notification is a legal and compliance requirement, not a breach event. The relevant amendment provisions came into force on 1 June 2025. JPDP guidance says qualifying notifications should be submitted to the Commissioner as soon as practicable and no later than 72 hours after the relevant awareness point. Federal Gazette, JPDP guideline |
Practical guidance
People should not search for themselves or others on an unlawful lookup service, purchase data, download files, or redistribute screenshots. Re-sharing personal information increases the potential harm and may expose the person sharing it to legal risk.
If you suspect your information has been exposed:
Change passwords that may have been reused elsewhere and enable multifactor authentication.
Watch for targeted phishing calls, SMS messages and emails that use real details to appear credible.
Contact the relevant organisation through its official website, not through a link supplied by an unknown sender.
Report suspected cyber incidents to Cyber999. Cyber999 lists 1-300-88-2999 for office-hours contact and +6019-266 5850 for emergency incident reporting.
Submit a personal-data misuse complaint through the Personal Data Protection Department.
If money has been transferred to a scammer, contact the bank immediately and call Malaysia's National Scam Response Centre at 997.
Methodology and source note
This report was prepared from official statements, government and regulator publications, company statements, incident-response reports and established reporting that reproduced official statements. The central June 2026 case sources are the JPN statement reported by Sinar Harian, the MKN/NACSA statement reported by Bernama, the MCMC blocking statement reported by RTM, and CyberSecurity Malaysia's Q2 2026 incident report.
The report distinguishes:
Confirmed: supported by a regulator, company, police statement or official incident report.
Partly supported: a related event is documented, but the screenshot's date, number, source or data fields are inaccurate.
Alleged/unresolved: an investigation or public claim exists without a published conclusion.
Unverified: no reliable corroborating source was located for the specific claim.
The original Threads post is included as the source of the public allegation: https://www.threads.com/@belumsetel/post/DZwoGhZE5a3. EXEPERT did not access the alleged lookup service and does not reproduce the supplied screenshots or any personal identifiers.
Nota editorial dan privasi
Laporan ini menyemak hantaran Threads awam serta kenyataan rasmi dan rekod insiden yang berkaitan. EXEPERT tidak mengakses perkhidmatan lookup yang didakwa, membeli data, memuat turun rekod atau mengehoskan tangkap layar yang diberikan. Benaman Threads pilihan yang dihoskan Meta mungkin memaparkan media daripada hantaran asal. Tiada butiran rekod peribadi disalin ke dalam laporan ini.
Ringkasan kes
Satu hantaran awam oleh @belumsetel di Threads pada 19 Jun 2026 menghidupkan semula kebimbangan tentang sebuah laman carian yang kelihatan memaparkan maklumat peribadi rakyat Malaysia. Hantaran itu mempersoalkan bagaimana data rakyat dan tokoh awam boleh terdedah dalam talian serta sama ada menyekat laman tersebut melalui DNS dapat menyelesaikan masalah. Hantaran asal Threads
Hantaran itu ialah sumber yang sah untuk memahami perkara yang dibincangkan secara terbuka. Namun, hantaran tersebut bukan bukti forensik tentang asal-usul rekod, tarikh data dikumpulkan atau sama ada sistem kerajaan telah diceroboh.
Kesimpulan paling kukuh yang disokong oleh rekod awam adalah lebih terhad: pihak berkuasa telah menangani pengedaran data peribadi selama beberapa tahun, dan bahan yang dibincangkan pada Jun 2026 diterangkan oleh JPN dan NACSA sebagai berkaitan dengan insiden lama. Rekod awam tidak membuktikan bahawa setiap rekod yang dipaparkan oleh laman itu datang terus daripada JPN, bahawa maklumat tersebut baru dicuri pada Jun 2026, atau bahawa setiap rekod yang dipaparkan adalah tepat.
Apa yang dinyatakan dalam rekod rasmi
Jabatan Pendaftaran Negara (JPN) menafikan bahawa sistem terasnya telah dikompromi. JPN berkata dakwaan yang tular itu mengitar semula insiden yang telah ditangani pada 2021 dan 2022, melibatkan sebuah agensi luar yang menyimpan data yang dikongsi untuk penyampaian perkhidmatan. JPN berkata laporan polis dan laporan kepada MCMC telah dibuat, manakala kawalan perkongsian data telah diperketatkan. Kenyataan JPN seperti dilaporkan Sinar Harian
Majlis Keselamatan Negara, melalui Agensi Keselamatan Siber Negara (NACSA), kemudian menyatakan bahawa maklumat yang tersebar dipercayai diperoleh secara tidak sah melalui pencerobohan terhadap pelbagai sistem sebelum 2022 dan kemudiannya diedarkan semula melalui platform dalam talian. NACSA berkata pihaknya bekerjasama dengan MyNIC, Jabatan Perlindungan Data Peribadi dan polis bagi tindakan menyekat, menurunkan kandungan serta menjalankan forensik digital. Laporan Bernama mengenai kenyataan MKN/NACSA
Kerajaan telah mengesahkan bahawa MCMC menyekat caghi[.]com pada Jun 2022. Pada September 2025, Menteri Komunikasi berkata kerajaan masih belum mempunyai pengesahan tentang status data yang didakwa disimpan oleh laman tersebut. Laporan RTM
Kenyataan ini mengesahkan bahawa pihak berkuasa telah menangani masalah pengedaran data peribadi selama beberapa tahun. Namun, ia tidak membuktikan sumber setiap rekod, kompromi semasa terhadap sistem teras JPN atau jumlah mangsa yang lengkap.
Kronologi: 2021 hingga 2026
Tarikh | Perkembangan yang didokumenkan | Status |
|---|---|---|
September 2021 | Polis membuka siasatan terhadap dakwaan penjualan data hampir empat juta rakyat Malaysia. Laporan menyatakan sistem JPN dan LHDN akan diperiksa; LHDN menafikan kebocoran dalaman. SoyaCincau | Dakwaan disiasat; sumber belum dipastikan |
Mei 2022 | Menteri Dalam Negeri berkata set data 22.5 juta rekod yang didakwa dijual bukan daripada JPN secara langsung dan dipercayai dikumpulkan daripada sumber serta agensi lain yang mempunyai akses. Bernama | Penafian rasmi terhadap sumber langsung JPN |
Jun 2022 | MCMC menyekat caghi[.]com, menurut pengesahan Menteri Komunikasi pada 2025. RTM | Tindakan sekatan akses disahkan |
November 2022 | Suruhanjaya Pilihan Raya menafikan dakwaan kebocoran melibatkan 800,000 pengundi dan berkata pihaknya bekerjasama dengan NACSA untuk menyiasat. Sinar Daily | Dakwaan disiasat; tiada pengesahan awam tentang pencerobohan sistem |
Disember 2022 | TM mengesahkan 250,248 pelanggan Unifi Mobile terjejas akibat kebocoran yang melibatkan nama, nombor telefon dan alamat e-mel. Kenyataan TM | Insiden disahkan |
Februari 2024 | MyCERT mendokumentasikan kempen R00TK1T yang melibatkan hantaran berkaitan Malaysia dan insiden terhadap beberapa organisasi. Nasihat MyCERT | Aktiviti kempen disahkan; setiap dakwaan perlu disemak berasingan |
Oktober 2024 | Polis mengumumkan tangkapan berkaitan sindiket yang didakwa mencuri dan menjual data rakyat Malaysia melalui portal Query Smart Search. Polis menyebut 400 juta rekod, yang tidak sama dengan 400 juta individu unik. Bernama | Dakwaan dan siasatan polis |
1 Jun 2025 | Beberapa peruntukan Akta Perlindungan Data Peribadi (Pindaan) 2024 mula berkuat kuasa, termasuk peruntukan pemberitahuan pelanggaran data. Warta Kerajaan | Tarikh kuat kuasa undang-undang, bukan kebocoran |
September 2025 | Menteri Komunikasi mengesahkan sekatan MCMC dan berkata status data yang dipegang laman tersebut masih belum disahkan. RTM | Kenyataan kerajaan disahkan |
Oktober 2025 | Kerajaan berkata JPDP dan MCMC bekerjasama dengan penyedia pengehosan, CDN dan pendaftar domain untuk menyekat serta menurunkan laman tersebut. New Straits Times | Tindakan kerajaan disahkan |
19 Jun 2026 | Hantaran akaun @belumsetel di Threads menghidupkan semula perhatian awam terhadap isu ini. Hantaran asal Threads | Dakwaan awam dan bahan sumber |
20 Jun 2026 | JPN menafikan kompromi terhadap sistem terasnya dan berkata dakwaan itu berkaitan insiden lama yang melibatkan agensi luar. Sinar Harian | Penafian rasmi |
21 Jun 2026 | MKN/NACSA berkata data tersebut dipercayai berpunca daripada pencerobohan sebelum 2022 dan diedarkan semula. Bernama | Penjelasan rasmi; butiran forensik belum diterbitkan |
Suku kedua 2026 | CyberSecurity Malaysia merekodkan 175 insiden kebocoran data yang dikendalikan Cyber999, berbanding 124 pada suku pertama. Laporannya memberi amaran bahawa sebahagian dakwaan kebocoran baharu sebenarnya ialah set data lama yang diedarkan semula. CyberSecurity Malaysia | Statistik laporan insiden, bukan bukti jumlah mangsa kes ini |
Had sekatan DNS
Sekatan DNS boleh menghalang pengguna pada resolver atau rangkaian tertentu daripada menyelesaikan nama domain seperti biasa. Ia boleh mengurangkan capaian kasual dan menyukarkan pengguna rangkaian yang terlibat daripada membuka laman tersebut.
Namun, sekatan DNS tidak memadam pangkalan data yang telah disalin, tidak mengenal pasti sumber asal, tidak memberitahu mangsa dan tidak menghalang maklumat yang sama daripada muncul di domain lain. ICANN menyatakan bahawa sekatan DNS tidak berkesan sepenuhnya dalam semua keadaan dan boleh dielakkan. ICANN SAC127
Dokumentasi resolver awam Cloudflare pula menjelaskan bahawa resolver standard 1.1.1.1 tidak menapis kandungan. Maksud teknikalnya ialah sekatan hanya berfungsi pada rangkaian atau resolver yang menguatkuasakannya. Dokumentasi Cloudflare
Tindakan yang lebih lengkap perlu merangkumi tindakan terhadap domain dan pengehosan, pemeliharaan bukti, siasatan forensik, pemberitahuan kepada organisasi dan individu terjejas, perlindungan akaun serta penurunan salinan yang disebarkan secara tidak sah. Sekatan DNS hanyalah salah satu langkah pembendungan.
Semakan fakta terhadap 15 dakwaan
Kronologi dalam tangkap layar kedua tidak wajar diterbitkan sebagai senarai kebocoran yang disahkan. Ia menggabungkan insiden yang disahkan, dakwaan, jumlah yang tidak tepat dan perkara yang bukan insiden kebocoran.
No. | Dakwaan dalam tangkap layar | Dapatan |
|---|---|---|
1 | Kebocoran telco 2014: 46.2 juta rekod | Sebahagiannya disokong, tetapi tarikh dan jumlah perlu diperjelas. Laporan polis/media pada 2017 menyebut 46.2 juta rekod pelanggan mudah alih dan secara berasingan menerangkan tawaran untuk menjual 50 juta rekod telekomunikasi. Tiada satu pun angka membuktikan jumlah individu unik yang terjejas; rekod itu mungkin termasuk nombor tidak aktif dan beberapa nombor bagi seorang individu. Laporan Malaysiakini/Bernama |
2 | Daftar perubatan 2017: 20,000 pengamal | Tidak sepadan dan tidak disokong seperti ditulis. Laporan pada 2017 menyebut 81,309 rekod profesional, manakala Persatuan Pergigian Malaysia mengesahkan kemungkinan serangan terhadap pangkalan data lama. Insiden berasingan pada 2019 melibatkan 19,922 rekod pesakit yang terdedah; ia bukan kebocoran daftar pengamal pada 2017. Kenyataan MDA, Laporan 2017, Laporan rekod pesakit 2019 |
3 | Kebocoran pelanggan Astro: 60,000 | Sebahagiannya disokong. Laporan 2018 merujuk kepada data sehingga 60,000 pelanggan IPTV. Astro mengakui dakwaan perkongsian tanpa kebenaran tetapi berkata siasatan ketika itu tidak menemui maklumat sulit pelanggan dalam simpanannya telah dikompromi. Senarai medan data dalam tangkap layar tidak patut dianggap fakta yang telah ditetapkan. Kenyataan Astro, Laporan semasa |
4 | Insiden Enrich Malaysia Airlines: 2019 | Pendedahan oleh penyedia pihak ketiga disahkan, tetapi tahunnya mengelirukan. Data yang terdedah meliputi Mac 2010 hingga Jun 2019 dan didedahkan pada Mac 2021. Medan data merangkumi nama, maklumat hubungan, tarikh lahir, jantina, nombor penerbangan kerap dan tahap keahlian. Tiada maklumat kad, jadual perjalanan, kad pengenalan atau bayaran dilaporkan dalam notis tersebut. Laporan insiden |
5 | JPN Siri 1, 2021: empat juta rakyat | Dakwaan yang belum diselesaikan. Polis menyiasat dakwaan penjualan hampir empat juta rekod dan meneliti kemungkinan kaitan JPN/LHDN. LHDN menafikan kebocoran dalaman. Tiada dapatan awam yang disemak mengesahkan data itu datang daripada JPN atau mewakili empat juta individu unik. SoyaCincau |
6 | JPN Siri 2 dan “kebocoran SPRM”, 2022: 22.5 juta serta 800,000 pengundi | Dua dakwaan telah digabungkan dan akronimnya salah. Dakwaan 22.5 juta rekod ditolak sebagai kebocoran langsung JPN oleh Menteri Dalam Negeri. Dakwaan 800,000 orang berkaitan Suruhanjaya Pilihan Raya, atau SPR, bukan SPRM. SPR menafikan pencerobohan sistem dan berkata NACSA sedang menyiasat. Pendedahan cap jari dan kebocoran SPR yang disahkan tidak dibuktikan dalam sumber yang disemak. Bernama, Sinar Daily |
7 | Kebocoran Carousell Malaysia: 2.6 juta pengguna | Insiden disahkan, tetapi keterangannya tidak tepat. PDPC Singapura mengesahkan insiden yang melibatkan penyenaraian forum bagi data kira-kira 2.6 juta pengguna Carousell. Carousell menganggarkan sehingga 3.389 juta individu mungkin terjejas. Pengguna tersebut adalah dari pelbagai negara, bukan Malaysia sahaja, dan keputusan pengawal selia tidak menyokong dakwaan bahawa kata laluan hilang. Keputusan PDPC |
8 | Telekom Malaysia dan Unifi Mobile: 250,000 | Disahkan dengan jumlah khusus. TM mengenal pasti 250,248 pelanggan terjejas dan menyatakan maklumat yang terdedah ialah nama, nombor telefon dan alamat e-mel. Kenyataan TM |
9 | Dakwaan kebocoran EPF i-Saraan, 2023 | Belum disahkan. Tiada sumber boleh dipercayai yang disemak mengesahkan insiden i-Saraan, jumlah mangsa atau senarai medan data dalam tangkap layar. Ia tidak patut diterbitkan tanpa bukti utama daripada KWSP atau pihak penyiasat. |
10 | Kempen R00TK1T, 2024 | Sebahagiannya disokong. MyCERT mengenal pasti 34 hantaran berkaitan Malaysia dan 16 insiden melibatkan 13 organisasi. MyCERT turut melihat penggunaan kelayakan yang dicuri melalui infostealer. Ini tidak membuktikan bahawa senarai e-mel kakitangan, kelayakan dan kontrak vendor dalam tangkap layar hilang dalam satu insiden. Nasihat MyCERT |
11 | Semakan keselamatan PADU, 2024 | Mengelirukan dan belum diselesaikan. Satu dakwaan mengaitkan fail berlabel “PADU” dengan sistem PADU persekutuan. Penjelasan kerajaan menyatakan rujukan itu ialah unit pengurusan dan penyampaian perkhidmatan LPPKN serta menafikan kebocoran sistem PADU persekutuan. Tiada sumber awam yang disemak mengesahkan ID sesi aktif dipintas. Bahan Kementerian Ekonomi |
12 | Kebocoran anggota pertahanan dan tentera, 2024: 14,000 orang | Tidak disahkan. Tiada pengesahan rasmi awam ditemui untuk dakwaan khusus melibatkan 14,000 orang pada 2024. Laporan berasingan tentang maklumat ketenteraan pada 2025 dan 2026 tidak boleh dianggap sebagai bukti untuk dakwaan ini. Laporan 2025, Laporan 2026 |
13 | Lonjakan kebocoran korporat, 2025 | Trend disokong, tetapi keterangan tentang satu insiden tidak disokong. CyberSecurity Malaysia merekodkan 195 laporan kebocoran data yang dikendalikan Cyber999 pada suku pertama 2025, berbanding 151 pada suku sebelumnya. Angka itu ialah laporan insiden, bukan jumlah individu unik. Laporan itu tidak membuktikan satu insiden melibatkan jutaan pelanggan, kelayakan Active Directory, helaian kewangan dan invois. Laporan CyberSecurity Malaysia |
14 | Penipuan korporat dipacu AI, 2025 | Ancaman itu nyata, tetapi dakwaan kehilangan data tidak disokong. Amaran Suruhanjaya Sekuriti bertarikh 22 Julai 2024 mendokumentasikan penipuan deepfake yang menyamar sebagai tokoh awam dan syarikat, mengumpul maklumat peribadi serta mengarahkan mangsa memuat turun aplikasi atau memindahkan wang. Amaran itu mendahului dakwaan insiden 2025 dan tidak mengesahkan pelanggaran data korporat. Tiada sumber yang disemak mengesahkan satu insiden korporat yang mencuri biometrik suara, imbasan wajah, identiti eksekutif dan kod pindahan wang. Amaran Suruhanjaya Sekuriti |
15 | Penguatkuasaan DBN mandatori, 2026 | Salah klasifikasi. Pemberitahuan pelanggaran data ialah keperluan undang-undang dan pematuhan, bukan insiden kebocoran. Peruntukan berkaitan mula berkuat kuasa pada 1 Jun 2025. Garis panduan JPDP menyatakan pemberitahuan yang memenuhi kriteria perlu dibuat secepat yang praktik dan tidak lewat daripada 72 jam selepas titik kesedaran yang berkaitan. Warta Kerajaan, Garis panduan JPDP |
Panduan praktikal
Orang ramai tidak patut mencari nama sendiri atau orang lain pada perkhidmatan lookup yang menyalahi undang-undang, membeli data, memuat turun fail atau mengedarkan tangkap layar. Perkongsian semula maklumat peribadi boleh menambah kemudaratan dan mungkin mendedahkan pihak yang berkongsi kepada risiko undang-undang.
Jika anda mengesyaki maklumat anda telah terdedah:
Tukar kata laluan yang digunakan semula pada perkhidmatan lain dan aktifkan pengesahan berbilang faktor.
Berwaspada terhadap panggilan, SMS dan e-mel pancingan data yang menggunakan butiran sebenar untuk kelihatan dipercayai.
Hubungi organisasi berkaitan melalui laman rasmi, bukan melalui pautan daripada penghantar tidak dikenali.
Laporkan insiden siber yang disyaki kepada Cyber999. Cyber999 menyenaraikan 1-300-88-2999 untuk waktu pejabat dan +6019-266 5850 bagi laporan kecemasan.
Buat aduan penyalahgunaan data peribadi melalui Jabatan Perlindungan Data Peribadi.
Jika wang telah dipindahkan kepada penipu, hubungi bank dengan segera dan telefon Pusat Respons Scam Kebangsaan di 997.
Kaedah dan nota sumber
Laporan ini disediakan berdasarkan kenyataan rasmi, penerbitan kerajaan dan pengawal selia, kenyataan syarikat, laporan tindak balas insiden serta laporan media yang memetik kenyataan rasmi. Sumber utama bagi kes Jun 2026 ialah kenyataan JPN yang dilaporkan Sinar Harian, kenyataan MKN/NACSA yang dilaporkan Bernama, kenyataan sekatan MCMC yang dilaporkan RTM serta laporan insiden suku kedua 2026 CyberSecurity Malaysia.
Laporan ini membezakan:
Disahkan: disokong oleh pengawal selia, syarikat, polis atau laporan insiden rasmi.
Sebahagiannya disokong: insiden berkaitan didokumenkan, tetapi tarikh, jumlah, sumber atau medan data dalam tangkap layar tidak tepat.
Dakwaan/belum selesai: dakwaan atau siasatan wujud tetapi kesimpulan belum diterbitkan.
Tidak disahkan: sumber yang boleh dipercayai untuk dakwaan khusus tidak ditemui.
Hantaran asal Threads dimasukkan sebagai sumber dakwaan awam: https://www.threads.com/@belumsetel/post/DZwoGhZE5a3. EXEPERT tidak mengakses perkhidmatan lookup yang didakwa dan tidak menerbitkan semula tangkap layar atau sebarang pengenal peribadi.