Maxis, a leading telecommunications provider in Malaysia, has reassured its customers that its system remains unaffected despite threats from the hacker group R00tk1t. The notorious group claimed to have breached Maxis’ infrastructure and threatened to expose a treasure trove of customer data. However, Maxis conducted an investigation and found no issues with its own systems. Instead, it discovered a suspected incident of unauthorized access to a third-party vendor system. While the vendor was not named, Maxis has pledged to work with them and relevant authorities to further investigate the breach.
Our customers’ privacy and security are of the utmost importance to us, Maxis stated in a press release. We are taking this incident seriously and have already implemented additional defense measures to minimize any further risk. The company emphasized that it will continue to provide updates on the situation as it develops.
Screenshots posted by R00tk1t in its Telegram group reveal what appears to be a database of users. However, these screenshots did not include personal identifiable information (PII). Instead, they displayed details such as the type of user (either home or SME), the model of the user’s router or modem, and what seems to be a serial number for each line. It is unclear whether R00tk1t possesses additional data that was not included in the sample screenshots.
Based on the screenshots, the data appears to belong to broadband users rather than mobile subscribers. This revelation raises concerns about the security of Maxis’ broadband services and the potential impact on affected customers.
This is not the first time R00tk1t has targeted Malaysia’s internet infrastructure. The group had previously issued warnings about its intentions to attack on January 26. On January 30, R00tk1t claimed to have breached Aminia, a local palm oil and network solutions company. Aminia also provides cloud services, Internet of Things (IoT) technologies, and networking equipment. R00tk1t shared a screenshot from what seems to be a back-end dashboard belonging to Aminia.
Recently, R00tk1t also boasted about defacing and breaching a local tutoring course website called YouTutor. The group allegedly stole a database containing 1886 lines of user data, including personal identifiable information (PII) such as full names, addresses, email addresses, phone numbers, MyKad numbers, and user IDs of the company’s staff, teachers, and students. This incident serves as a reminder of the potential consequences and risks associated with cybersecurity breaches in various industries.
Maxis’ response to the reported breach demonstrates its commitment to addressing the issue promptly and protecting its customers’ privacy and security. However, the situation underscores the need for robust security measures in the face of evolving cyber threats. Maxis is working diligently to investigate the incident and implement additional safeguards to prevent further unauthorized access.
As the investigation continues, Maxis customers are advised to remain vigilant and take necessary precautions to safeguard their personal information. Regularly changing passwords and being cautious of suspicious emails or communications are just a few steps users can take to protect themselves in an increasingly digital landscape.
In the coming days, Maxis will continue to provide updates on the progress of the investigation and any further developments concerning the breach.
