KUALA LUMPUR – The International Trade and Industry Ministry (Miti) is taken to task over the easy access of personnel information of company employees who signed up for the Pikas vaccination programme.
Former deputy minister Ong Kian Ming is demanding an explanation of the Pikas “data leak” and steps the ministry is taking to secure other databases, including the CIMS3.0 (Covid-19 Intelligent Management System).
He added that an IT and cybersecurity expert Suresh Ramasamy shared on LinkedIn that 2,000 Excel files containing possibly more than 1.7 million personnel data linked to the Pikas programme can be downloaded directly from the Miti website.
“Miti must come out with a statement to explain to the public as to why this data breach took place. Miti should also reach out to the companies whose employee data was listed in the Excel files that were publicly accessible – so that the employees at these companies can be on alert if their personal data is being used by others,” Ong said in a statement.
“Miti must clarify whether the IT security flaw was due to an error made by the IT department at the Malaysia Automotive, Robotics and IoT Institute (Marii), an agency under the ministry, is in charge of developing and maintaining the CIMS including the latest CIMS 3.0.
“Miti must also explain whether these IT breaches, possibly involving Marii, are due to the lack of leadership at this agency, especially after the removal of its CEO Datuk Madani Sahari, who was arrested and remanded by the Malaysian Anti-Corruption Commission (MACC), along with eight others, in March, over a project worth RM85 million.”
On May 31, Suresh wrote that there were possibly three scenarios why access to the Pikas Excel files was left open.
“An eager beaver wants to take home their work and asks the IT admin to leave the files open, or the IT development team needs the files to do batch processing and transfer them to a different server, or malicious staff wanting to sell data.”
The Pikas system has data points such as company name, NRIC/passport number, phone number and role in the company. – The Vibes, June 3, 2022
