KUALA LUMPUR – Questions are being raised on whether there has been a data breach involving a major bank in Malaysia.
In an email to its customers yesterday evening, RHB Banking Group said that there has been an error in e-statements that were sent out the previous night due to a technical issue.
Apologising for the error, the bank urged users to refrain from opening the statement and to immediately delete the email.
It added that a new e-statement will be re-sent to patrons as soon as possible upon appropriate validation being completed.
“Our team is currently investigating the matter, while simultaneously rectifying the error that had occurred,” the group said.
Yesterday, several users took to social media claiming to have received personal bank account statements belonging to other customers.
More concerning, they claimed they were able to access the e-statements using their own passwords, which, by default, is the users’ date of birth in numerals.
Among the personal data that can be obtained from the statement include the customer’s full name, home address, transaction history, salary amount deposited and account number.
In a Facebook post, Heng WK said he had received another person’s e-statement and asked if his own details had been wrongly sent to other users.
“Anyone who has this problem please lodge a complaint on serious breach of the Personal Data Protection Act 2010,” he said, adding that it is unacceptable for such a mistake to be committed by a bank.
Shanker Joyrama similarly questioned how he was able to receive and access the bank statement of another person, and asked if anyone else had faced similar issues.
“Does this mean that my own statement has been sent to someone else who will be able to open it up because the password is theirs and be privy to all my personal information?” he questioned.
Acknowledging the follow-up email by RHB apologising for the error, Shanker said this does not absolve the bank’s commitment to ensure their customers’ privacy.
Several users commented on the post saying they faced similar issues, and that their attempts to contact RHB were unsuccessful.
The Vibes attempted to contact the bank’s hotline for clarification, but no agents were available to speak at press time.
An email has also been sent to RHB’s communications unit and The Vibes awaits a response.
It is unclear at the moment how many accounts have been affected by the possible privacy breach.
Users fear personal data could be abused
Speaking to The Vibes, several RHB customers expressed grave concern that their statements might have been sent to someone else and that their data might be abused.
An executive at a private firm who only wanted to be known as Shareena, said while she did receive her own statement, her worry is that the document might have also been sent out to other users.
She said many of her colleagues also expressed similar concerns after receiving RHB’s email on the error it committed.
“We will see what we can do collectively. There is no point of me complaining alone; I need to get my organisation involved to ensure all accounts are safe and that the private details remain private,” she said.
Another user who requested anonymity said, while not everybody received the wrong statement, the issue of compromised personal data should not be swept under the carpet.
“RHB must clarify how many accounts were compromised and how this actually happened,” the user said.
However, data engineer Alvin Teoh said the compromised data are unlikely to cause any major problems to account holders.
He said that, even if the e-statement had been emailed out wrongly, it is most likely to only reach the hands of a fellow RHB customer.
“As long as they don’t know your bank account password, then I feel there is not much to be worried about,” he told The Vibes.
The only worry, he said, is that those with ill-intentions may use details, such as home addresses, to commit a crime like robbery and break-ins, if the person is wealthy.
“Other than that, I don’t see any problems arising. There may be concerns on scams, but scammers can’t do anything much if they only have details of just a single person,” he said.
On what could have caused the issue, Teoh said it is likely a system glitch that caused the emails to be sent to the wrong address. – The Vibes, June 18, 2021
