Malaysia’s new database plan runs into privacy concerns amid recent hacks, data leaks

The Malaysian government recently unveiled an ambitious plan to consolidate its databases on the country's population into a single system, known as Padu. The initiative, led by the Economics Ministry, aims to provide a comprehensive picture of the nation's 33. 5 million inhabitants. However, the launch was marred by concerns over potential identity theft, given Malaysia's history of data leaks and cybersecurity breaches.

Shortly after the launch, Rafizi Ramli, the Minister of Economy who spearheaded the project, acknowledged a loophole in the registration process. This flaw could potentially enable identity theft. Former deputy international trade minister Ong Kian Ming revealed that anyone with knowledge of another person's identity card (IC) number and home postcode could register as that person. This revelation sparked widespread concern, despite Rafizi's assurance that such registrations would only be recorded in the database once the electronic Know Your Customer (eKYC) process was completed. This process involves submitting photos of the IC and a selfie of the account holder.

Despite Rafizi's assurances, the public remained skeptical, and calls for the suspension of the registration process until a proper fix is implemented have grown louder. This skepticism is not unfounded, as Malaysia has a history of data security breaches. In 2022, the personal data of 22. 5 million citizens was stolen from government servers and sold on the dark web. Furthermore, the private messaging accounts of the then-prime minister and his cabinet were hacked. Given this backdrop, the concerns surrounding the Padu system are understandable.