.png)
SHAH ALAM - The alleged leak of entrepreneur and content creator Khairul Aming's Maxis billing information has reignited concerns over whether Malaysia's Personal Data Protection Act (PDPA) remains adequate for an increasingly digital economy.
The incident has also prompted experts to call for stronger enforcement, tougher penalties and greater corporate accountability in protecting personal data.
Cybersecurity expert from the International Islamic University Malaysia Emeritus Professor Datuk Dr Mohamed Ridza Wahiddin said the incident exposed significant weaknesses in corporate data governance and internal data protection.
He added that it has renewed concerns over how organisations handle personal data.
He said although Maxis described the incident as an isolated case involving an individual perpetrator rather than a wider database breach, it exposed shortcomings in internal access controls and data protection measures.
“Coupled with frequent public complaints about personal information ending up in the hands of scammers, telemarketers and property agents, the incident points to broader systemic vulnerabilities, including inadequate monitoring of staff access and weaknesses in internal data security,” he told Sinar Daily.
Ridza said the case has reignited public concerns over whether personal data protection laws are enforced consistently, regardless of an individual's profile.
While the swift response from Communications Minister Datuk Seri Fahmi Fadzil and the investigation launched by the Personal Data Protection Department (JPDP) reflected the seriousness of the incident, the victim's high-profile status has fuelled perceptions that ordinary Malaysians do not receive the same level of attention when their personal data is compromised.
He noted that many individuals who experience similar data breaches often encounter slower or less visible enforcement, highlighting the need for a consistent and robust regulatory response regardless of a victim's public profile.
He added that while the PDPA has undergone amendments in recent years, Malaysia's legal framework must continue evolving to keep pace with increasingly sophisticated cyber threats.
“PDPA is no longer fully suited to today’s digital environment. While recent amendments have sought to modernise the legislation, past enforcement has lacked sufficient deterrent effect amid increasingly frequent cyber threats.
“Strengthening the framework requires higher financial penalties for non-compliance, mandatory breach notification requirements that compel organisations to promptly inform regulators and affected individuals and clearer criminal liability for organisations and personnel whose negligence results in data breaches,” he said.
Ridza advised individuals who suspect their personal information has been compromised to act immediately to minimise potential risks. This includes changing passwords, enabling multi-factor authentication, securing all relevant accounts and closely monitoring bank accounts for any unauthorised transactions.
He also urged affected individuals to preserve evidence, such as screenshots, messages or recordings related to the suspected misuse and lodge reports with the police and the JPDP.
He noted that under the current PDPA, individuals may also file formal complaints to trigger investigations or pursue civil claims where negligence can be established.
Looking ahead, Ridza said restoring public confidence would require stronger regulatory reforms alongside improved corporate governance.
“To strengthen Malaysia’s data protection framework and restore public confidence, several reforms remain necessary.
“These include imposing substantially higher penalties on organisations that fail to safeguard personal data, introducing mandatory timelines for breach notifications, strengthening corporate accountability by placing greater governance responsibilities on boards and senior management and empowering the JPDP to conduct proactive and random compliance audits rather than relying solely on investigations after breaches occur.
“Beyond regulatory reforms, technological solutions may also play an important role.
“In Malaysia, MIMOS Berhad is spearheading Trusted Intelligence, an advanced technology that has the potential to strengthen cybersecurity and address emerging threats, including sophisticated social engineering attacks such as deepfakes,” he said.
Yesterday, Khairul Aming, whose real name is Khairul Amin Kamarulzaman, took legal action over an alleged personal data leak by lodging four reports with authorities and issuing a Letter of Demand to telecommunications provider Maxis.
In a Threads post, he said reports had been lodged with the Malaysian Communications and Multimedia Commission (MCMC), JPDP and Dang Wangi District Police Headquarters (IPD) to investigate the alleged unauthorised disclosure of his personal information.
The move came after he questioned how details of his personal phone bill, payment history and other private information were obtained and shared publicly on social media.
Previously, Maxis said it had identified the individual allegedly involved in the unauthorised access of a customer’s account details and had taken immediate action.
Khairul said his legal team would handle the matter until its conclusion, expressing concern over the ease with which personal privacy could be compromised.
