Threat actors claim breach of over a dozen Malaysian government websites
Learn More
Cybercriminals have allegedly compromised more than a dozen Malaysian government websites and are offering unauthorized access to these critical systems for sale on a dark web forum.
The breach was posted on the Dark Forums website by a user identifying themselves as "Bigbrother," with the posting titled "First time breach/leak." The threat actor claims to possess both live access to the compromised government systems and complete data dumps from the affected organizations.
The government entities allegedly affected by this breach include:
- National Registration Department (JPN), which handles citizen identification records,
- MyGovernment portal that serves as a central hub for government services,
- Radio Televisyen Malaysia (RTM), the country's national broadcaster.
- Ministry of Health,
- Ministry of Defence,
- Ministry of Foreign Affairs,
- Ministry of Higher Education
The nature of the attack and number of affected individuals are not disclosed. The hacker is ffering to sell the access to the systems for US$20,000 (approximately RM85,500), with payments accepted exclusively in Monero cryptocurrency to maintain transaction anonymity.
Exposed data types allegedly include:
- VPN account connection information
- Shell access credentials
- Network and web databases
- Subdomain information
- Local file-sharing details
Security experts note that the asking price pricing appears unusually low for such extensive government access. An anonymous cybersecurity expert quoted by the media suggested that the relatively modest asking price could indicate either that the compromised data is not critical, or that the breach was conducted by inexperienced individuals who may not fully understand the true value of the access they have obtained.
Cybersecurity Malaysia, the country's national cybersecurity specialist agency, has been officially notified of this alleged breach and is presumably conducting investigations to determine the validity of the claims and assess the potential scope of any compromise. The agency has not yet released any public statements regarding the incident or provided guidance to potentially affected citizens.
