27/07/2026

MONDAY | JULY 27, 2026

FOLLOW

ON YOUTUBE

4

Malaysian Paper

/theSunMedia /

‘Address data leak risks before information is breached’ o Companies should not rely on methods that are only able to identify culprits after incidents occur: Expert

Youth must be patriotic, digitally literate: Minister

JEMPOL: Youth, particularly secondary school students, must be continuously nurtured with a strong sense of patriotism and equipped with a sound understanding of digital literacy and ethical social media use to face the challenges of the modern era, said Communications Minister Datuk Seri Fahmi Fadzil. He added that emphasis on nationhood and history is crucial to ensure every citizen understands their responsibility in helping to advance the country. “As a son or daughter of this nation, as a citizen, we also have responsibilities and must understand our history, as well as our roles and duties in becoming Malaysians who can help move the country forward. “I also took the opportunity to listen to questions and views from the Form Six students, and I found that most of them are highly motivated and understand current challenges, including fake news, mental health issues, social media, and many also asked about the future amid the rapid growth of technology, including artificial intelligence (AI).“ He was speaking to reporters after meeting 60 Form Six students following a dialogue session held in conjunction with the Pentarama X Kelab Malaysiaku programme and the Safe Internet Campaign at the Jempol District Information Office yesterday. The programme, organised by the Information Department, brought together students from Sekolah Menengah Kebangsaan (SMK) Batu Kikir, SMK Seri Perpatih and SMK Datuk Mansor in the Jempol parliamentary constituency. Also present were the department’s director-general Erwin Khairul Ahmad and Negeri Sembilan Malaysian Communications and Multimedia Commission director Faisal Hamdi Mohammed Ghouth. Fahmi said the programme, which adopts an “edutainment” approach, not only enhances the National Month celebrations but also serves as an interactive two-way platform for the ministry’s leadership to hear the views and aspirations of the younger generation. Meanwhile, Erwin Khairul said the programme has now been expanded to promote the messages of independence, unity and preparations for the National Day and Malaysia Day celebrations at the school level. He added that to date, there are 850 Kelab Malaysiaku nationwide. Pentarama is a performance unit under the Information Department that communicates government policies, official information and patriotic values through singing, dancing and drama. – Bernama She also said endpoint forensic examinations should also be carried out on the employee’s work computer or device to determine whether personal data had been stored locally, shared through messaging applications or transferred to external storage devices. However, Syifak said the company’s liability would depend partly on whether adequate technical and administrative safeguards had been implemented and consistently enforced. “If all the appropriate controls were in place and the incident still occurred, then it may ultimately involve an employee who was dishonest and failed to understand the duty of confidentiality.“ Syifak said Section 9 of the Personal Data Protection Act 2010 requires data controllers to implement sufficient technical and organisational measures to protect personal information from unauthorised access, disclosure and misuse. – By Faiz Ruzman

He added that the attention generated by Khairul’s case should not overshadow similar incidents involving ordinary customers. On July 20, a Threads user publicly shared information allegedly linked to Khairul’s Maxis account. The influencer, known for his cooking content, has amassed a large following across Instagram, TikTok and other social media platforms. The information shared allegedly included details of his outstanding telephone bill and other customer information. The same user also published information relating to Khairul Aming’s MySara status, although it has yet to be established whether both sets of information originated from the same source. Maxis later confirmed that an unauthorised action had taken place, saying the individual linked to the incident had been identified and describing it as an “isolated” case. However, the company has not disclosed whether the individual was an employee, contractor, dealer, agent or affiliated with a third-party service provider. Khairul subsequently announced on July 22 that his lawyers had issued a Letter of Demand to Maxis and that reports had been lodged with the police, the Malaysian Communications and Multimedia Commission and the Personal Data Protection Department.

Ű BY FAIZ RUZMAN newsdesk@thesundaily.com

Malaysia Centre for Cybersecurity and Data Intelligence senior researcher Assoc Prof Dr Zubaile Abdullah said it was still too early to conclude that all the information shared had originated directly from the telecommunications company’s systems. He said investigators must establish the provenance, or original source, of each piece of data and determine whether it was obtained directly, supplied by someone with legitimate access or compiled from other exposed sources. “A match with customer records alone does not prove the source of the entire dataset.“ Zubaile also cautioned against assuming that the individual who published the information was the one who originally obtained it. “The exposure of a celebrity’s data should not be the reason we suddenly recognise the seriousness of the problem. “If similar incidents have affected ordinary individuals, they deserve the same level of attention and protection. “The real issue is not who the victim is, but whether personal data is being adequately protected.”

PETALING JAYA: The alleged unauthorised disclosure of the personal account details belonging to social media influencer Khairul Amin Kamarulzaman (Khairul Aming) has raised fresh concerns over whether companies are equipped to detect and stop suspicious access to customer records before sensitive information is exposed to the public. Universiti Malaya Centre of Research for Cybersecurity and Network professor Dr Ainuddin Wahid Abdul Wahab said organisations should not rely solely on audit trails that identify who accessed customer records after an incident but also have monitoring systems capable of detecting and responding to suspicious activity before confidential information is disclosed. He added that the issue was not simply whether someone possessed valid system credentials, but also whether there was a legitimate operational reason to access a customer’s records. “It is like a bank employee who only needs to verify a customer’s name but is nevertheless given access to the person’s account balance and entire transaction history,” he told theSun . “Automatic alerts should be triggered whenever certain accounts are accessed, especially those belonging to prominent individuals or celebrities. “Regular audits should also be carried out to detect unusual access before it escalates into a public issue.” He also said companies should adopt the principles of least privilege and segregation of duties, ensuring employees could only access information necessary to perform their roles, while automated alerts should flag access to sensitive or high-profile customer accounts for immediate review. “Security teams should be able to verify immediately whether an account had been accessed for a genuine customer service matter or an authorised work assignment. “This is particularly important for accounts belonging to VIPs or celebrities, while regular audits should be conducted to identify unusual access before it becomes a public issue.” Meanwhile, Universiti Tun Hussein Onn PETALING JAYA: The alleged misuse of customer data in the telco leak highlights a growing cybersecurity risk, in which employees with legitimate system access may exploit confidential information for social media attention, a cybersecurity expert warned. Universiti Malaysia Pahang Al-Sultan Abdullah Computer Network and Cyber Security Department head Dr Syifak Izhar Hisham said the rise of “clout culture” had led some individuals to prioritise online popularity over legal and ethical responsibilities, turning protected customer information into sensationalised content. “Sometimes, the incidents happen because of the trend of clout culture. Influencers or social media users seek likes and followers by revealing information that attracts public attention. “It becomes content over everything. They forget that disclosing this type of information can constitute a crime,“ she told theSun .

SCENIC SPOT ... Tourists take photographs at the River of Life lookout point near Dataran Merdeka in Kuala Lumpur. – ADAM AMIR HAMZAH/THESUN

‘Clout culture causing prioritisation of online fame over ethics’

such as MyKad numbers were not displayed in plain text to employees who did not require full access. Syifak said access to customer records should only be granted in response to legitimate customer requests, while role-based access controls should restrict sensitive information to a limited number of authorised personnel. “If an employee could easily access and capture private MyKad information without adequate logging, role-based restrictions or data masking, it would indicate that the necessary safeguards were not properly in place.” She added that to determine whether other customers had been affected, the telco should conduct a comprehensive audit trail of every search made using the employee’s user ID from the date access was first granted. “This would show whose accounts were previously searched or viewed by the individual throughout the period of employment.“

Syifak said the pattern observed in the Khairul Aming case appeared more consistent with an insider threat involving the misuse of authorised system access than a cyber attack by an external actor. She added that the information disclosed was highly specific to a single individual, rather than a large collection of records typically targeted by cybercriminals for resale or broader exploitation. The fact that the telco was able to identify the person involved also suggests that the activity came through a traceable internal account or system, she said. “An outsider would normally target an entire database because a larger volume of information has greater value for sale.“ She also said organisations handling sensitive customer records should implement data masking to conceal confidential information from unauthorised personnel, ensuring details