Malaysia Telecom & Citizen Data Breach (2017-2018)
Widely regarded as the largest data security breach in Malaysian history, an immense cross-industry compilation originating from major mobile carriers and public registries was compromised between 2017 and 2018 and subsequently released on BreachForums.
Exposed Data Types
6- Government issued IDs
- Names
- Phone numbers
- Physical addresses
- Dates of birth
- Genders
About This Breach
The exposed archive (Malaysia - Mixed Data.txt) aggregates 158,036,651 entries compiled across key telecommunications providers (including Celcom, Maxis, Digi, U Mobile, and Telekom Malaysia), banking institutions (Maybank, CIMB), and statutory databases (the Election Commission - SPR, and BR1M welfare registries). Compromised records prominently feature citizens' 12-digit National Registration Identity Card numbers (MyKad IC), full legal names, mobile phone numbers, and complete physical residential addresses across all Malaysian states.
Surpassing the entire adult population of Malaysia, the dataset's direct pairing of official national identity numbers with real-time telecommunications identifiers creates severe ongoing exposures to SIM-swap fraud, telemarketing abuse, and unauthorized banking verification exploits.
Malaysian residents and account holders are advised to utilize hardware or authenticator-app verification rather than SMS one-time pins and monitor credit histories for unapproved inquiries through CTOS/CCRIS.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
