Influencer and entrepreneur Khairul Aming has sent a letter of demand to Maxis following the alleged leak of his personal data, as multiple Malaysian authorities continue investigating the incident. In a post on social media, Khairul confirmed that official reports have been lodged with the Malaysian Communications and Multimedia Commission (MCMC), the Royal Malaysia Police (PDRM) and the Personal Data Protection Agency (JPDP).
“My lawyers will take on the case until it is resolved,” Khairul wrote. He also expressed concern that his personal information, including his phone details, payment history, subscription information and MyKad number, was allegedly exposed online.
An Unexpected Leak On Threads
The issue came to light on Monday after Khairul’s personal information was leaked on Threads. Following this, he publicly questioned Maxis over how his phone bill details had been accessed and widely circulated on social media. The incident quickly drew public attention and prompted responses from both the telecommunications provider and government authorities.
Speaking to reporters yesterday during the International Regulatory Conference (IRC) 2026, Communications Minister Datuk Fahmi Fadzil confirmed that MCMC had begun investigating the matter after receiving an official complaint from Khairul. He added that MCMC would work with the Personal Data Protection Agency (JPDP), which falls under the Digital Ministry, to determine whether any provisions under the Personal Data Protection Act (PDPA) 2010 had been breached.
Under the Act, the unlawful disclosure of personal data is an offence punishable by a fine of up to RM500,000, imprisonment for up to three years, or both.
JPDP Launches Investigation Under PDPA
In a statement issued today, the Personal Data Protection Agency (JPDP) confirmed that it has opened an investigation into the alleged unauthorised disclosure of Maxis customer data. According to the agency, the investigation is being carried out under the Personal Data Protection Principles as well as Section 130 of the Personal Data Protection Act 2010 (Act 709), which covers offences relating to the unlawful collection or disclosure of personal data.
JPDP said that enforcement action would be taken should its investigation find any non-compliance with Act 709. The agency also reminded all data controllers to comply with the Act’s seven Personal Data Protection Principles, emphasising the need to adequately protect customer information from unauthorised access or disclosure. It further urged organisations to continuously strengthen their technical and organisational security measures, including ensuring that their data storage infrastructure and network systems maintain an appropriate level of security.
Maxis Says Incident Was Isolated
Maxis maintained that the alleged data exposure was an isolated case resulting from unauthorised actions. The telco stated that its preliminary investigation indicates no other customers were affected by the incident.
The telco also said that all access to customer accounts is fully logged, enabling it to identify the individual linked to the incident, although their identity has not been publicly disclosed. Maxis added that it has initiated immediate action, including legal proceedings, against the individual involved.
