A cyberattack has disrupted the Flexi Parking platform used by 64 local authorities across Malaysia, causing widespread issues with digital parking payments while several councils have temporarily suspended parking summons enforcement until the system is restored.
As reported by Malay Mail, Selangor Local Government and Tourism Committee chairman Datuk Ng Suee Lim confirmed that the incident involving the Flexi monitoring system is not limited to Selangor but affects 64 local authorities nationwide.
He said the system was hacked and restoration works are currently underway. The interrupted had resulted in difficulties for motorists attempting to pay for street parking. As a temporary measure, all affected local authorities have been instructed not to issue parking summonses while the system remains unavailable.
Ng added that they hope to restore the system by today or tomorrow and return operations to normal as soon as possible.
Flexi Parking app had faced issues since yesterday
The Flexi Parking app has remained offline since yesterday.
In its latest update shared on social media today, Flexi Parking said system recovery works are still ongoing and that its app service remains unavailable. The company added that it is working to restore services safely and reliably, and will continue to provide updates through its official channels.
Several local authorities have also issued public notices about the disruption.
DBKL has advised motorists to use alternative parking payment apps including EZ KL Smart Park, Setel and Mcash while the Flexi Parking service is unavailable.
Meanwhile, Perbadanan Putrajaya has asked motorists to use Touch ‘n Go cards, debit cards or credit cards at controlled parking locations as an alternative until the system is restored.
Port Dickson Municipal Council (MPPD) also announced that parking payment services and parking enforcement activities have been temporarily suspended while Flexi Parking completes recovery works and technical testing.
Researchers allege attackers claimed access to 7 million records
Separately, cybersecurity firm Gotchaa Lab has shared a technical analysis of the alleged attack linked to findings shared by Najoe.
According to the findings, a threat actor calling itself “MelayuSpiritual” claimed to have obtained root access to the Flexi Parking server and gained access to a database which reportedly contained around 7 million user records.
The post also alleged that the attackers exploited a SQL injection vulnerability together with an unauthenticated file upload vulnerability to compromise the system. You can read their full findings here.
