A database that apparently belongs to the National Registration Department (JPN) has been put up on sale at a well-known database marketplace forum. The seller claimed that it contained four million data that was obtained from the Inland Revenue Board’s (LHDN) website through API that is made for myIDENTITY.
For those who are not familiar with myIDENTITY, it is essentially the national data sharing platform for the public sector that allows government agencies to obtain one’s personal details from a centralised repository. 10 agencies including both JPN and LHDN are currently linked to the platform which first went live in June 2012.
First highlighted by a local Intrusion Analyst, Adnan Shukor, the seller noted that the database contained plenty of important information such as full name, NRIC number, mailing & permanent addresses, mobile number, and e-mail address. Not only that, there are also images present in the database which is being grouped according to one’s birth year that ranges from 1979 to 1998.
This is not the first time that this particular seller has put up a database from Malaysian organisations for sale at the marketplace forum. Back in February, the same seller had listed a database that claimed to be from the local e-commerce platform Ifmal, as well as another set from the Election Commission of Malaysia (SPR).
However, the seller didn’t put any prices on the previous two listings as opposed to JPN’s database which comes with a price tag of 0.2 BTC. At the current market rate as of 8:34 AM Malaysian time today, that is equivalent to around RM 35,495.
At the moment, it is not known whether JPN or LHDN are already aware of the listing. Regardless of its authenticity, the listing is still something that the authorities need to investigate urgently as it may involve tons of personal data as well as the integrity of myIDENTITY platform.
(Thanks for the tips, @Hathaway_Noaa!)
