# MA-841.062022: MyCERT Alert - Security Best Practices on Data Breach

**Date:** 14 Jun 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-841.062022  
**Advisory ID:** MA-841.062022

---

**1.0 Introduction**
Recently MyCERT observes a massive amount of Personal Identification Information (PII) circulated publicly in cybercriminal forums and public websites. The PII database dump is obtained from compromised websites and sold in a forum using bitcoin currency and on the public websites using USD currency. Excerpts of the database have been posted in the cybercriminal forum as proof that the data collected is legit. While, for the public website user can search the PII using the name, address, phone number, personal identification number, military identification number or date of birth. The data exposed poses threat issues to the organisation and the individual that owns the data.
Hence, MyCERT would like to advise individuals to be more alert and vigilant as well as system owners to adhere to the latest security updates and follow best practice security policies to determine which updates should be applied.
**2.0 Impact**
The impact of a data breach depends on the nature and extent of the breach and the type of information that has been compromised. Some breaches may involve only one or two people while others may affect hundreds or thousands. Larger breaches expose a wider group of people and could require considerable notification and remediation activities.
Serious impacts of a data breach could include:
Risk to individuals’ safety
Increase fraudulent activities such as scams and impersonation
Financial loss to an individual or organization
Damage to personal reputation or position
Loss of public trust in an Agency or the services it provides
Commercial risk through disclosure of commercially sensitive information to third parties
Threat to an Agency’s systems, impacting the capacity to provide services
Impact on Government reputation, finances, interests, or operation.
Loss of data integrity.
**3.0 Recommendations**
Protection of sensitive data is required not only for legal or ethical reasons but for issues 
MyCERT has prepared guidelines from the previous advisory that covers the steps to prepare before the incident occurs and suggested response action to be taken after the incident had taken place as below:
- [MA-821.102021: MyCERT Advisory - Best Practices When Personal Information is Breached](https://mycert.org.my/portal/advisory?id=MA-821.102021)
- [MA-746.092019: MyCERT Advisory - Security Best Practices on Data Breach Incident](https://www.mycert.org.my/portal/advisory?id=MA-746.092019)
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**4.0    References**
1) <https://www.nst.com.my/news/nation/2022/06/804326/cyber-security-experts-raise-alarm-over-possible-data-breach-involving>
2) <https://www.thestar.com.my/tech/tech-news/2022/05/18/data-of-malaysians-born-between-1940-and-2004-allegedly-being-sold-for-over-rm40000>
3) <https://www.lowyat.net/2022/275155/miti-site-left-employee-data-under-pikas-exposed/>
4) <https://codeblue.galencentre.org/2022/05/31/miti-site-allegedly-exposed-personal-data-of-workers-registered-for-covid-19-jabs/>