Personal data of Malaysians allegedly from SPR still being sold online, months after leak

Earlier this year, we had reported that a data breach had apparently occurred at the Election Commission, resulting in a database containing the details of over 800,000 Malaysians being sold online. It’s now been over half a year since that breach was listed, but it seems that it’s still being available online.

This data contains pictures of Malaysian identification cards, names, email addresses, phone numbers, birthdays, addresses and even selfies of these Malaysians holding up their IC cards. There’s a total of 802,259 Malaysians involved, with 67GB of data in total. The seller is asking for USD2,000 for this database, to be paid via cryptocurrency. This data was allegedly sourced from the MySPR website; this was where you’d go to register as a voter prior to the implementation of automatic voter registration.

For context, when Malaysians wanted to register as a voter online back then, you would use the MySPR Daftar system. This required users to include their personal details along with a picture of their identification card and a photo of them holding it up to the camera for electronic Know Your Customer (eKYC) purposes. It’s no longer being used for voter registration, but the MySPR system still exists for some reasons such as for changing their voting address, or to register for postal voting.

Now despite being first listed online in April, the listing is still live, with the seller keeping the thread alive as recently as this week. It’s certainly quite worrying to see this, especially considering that when the data breach was first made known so long ago. The concern is is not only does the perpetrator and anyone who buys this database have access to the details of Malaysians and their identification number, but also an eKYC image of them holding up their IC which can be abused by these bad actors to apply for products and services without them knowing.