MAXIS has identified the individual allegedly responsible for leaking content creator and entrepreneur Khairul Aming's mobile billing information, describing the incident as an isolated case of unauthorised access and confirming that legal action is being pursued.
The telecommunications company said its investigation had established the identity of the individual linked to the incident and that immediate measures were being taken to address the breach.
"We have identified the individual linked to this incident and are taking immediate action, including legal action," the telecommunications company said in a recent statement.
Maxis said it had contacted the affected customer and emphasised that its investigation had found no evidence of a wider compromise involving other subscribers.
"All access to customer accounts is fully logged and monitored. Our findings indicate that this is an isolated incident involving an unauthorised action.
"There is no indication of any broader incident involving other customers," the company said.
Apologising to Khairul Aming, Maxis reiterated its commitment to safeguarding customers' personal information.
"We sincerely apologise for this incident. We remain deeply committed to data privacy and protection of personal data," it said.
The incident came to light after Khairul Aming questioned on Threads how another social media user had obtained details of his personal mobile phone bill and published them online.
The user allegedly claimed that Khairul Aming had outstanding mobile phone charges amounting to RM498 and also referred to several digital add-on purchases associated with his account.
The disclosure has drawn the attention of regulators, with Communications Minister Datuk Seri Fahmi Fadzil announcing that the Malaysian Communications and Multimedia Commission (MCMC) will obtain a comprehensive report into the alleged data breach.
Fahmi said the allegations were being treated seriously because they suggested that an unauthorised individual may have gained access to confidential customer information as well as the telecommunications provider's internal inventory or operational systems.
"I have already met with representatives of the telecommunications company, and they informed me that they are in the process of contacting Khairul Aming.
"I will also instruct the Malaysian Communications and Multimedia Commission (MCMC) to obtain a full report on this matter," he said after officiating the International Regulators Conference (IRC) 2026.
The minister stressed that the unauthorised dissemination of personally identifiable information (PII) is an offence under the Personal Data Protection Act and that those responsible could face legal action.
He also urged members of the public who experience similar incidents to lodge reports with MCMC to enable the commission to collect the necessary evidence and take appropriate enforcement action. - July 21, 2026
