KUALA LUMPUR: Initial investigations into the data leak involving five million AirAsia passengers and staff found there was a cyberattack on AirAsia's server system on Nov 12 resulting from unauthorised access.

Communications and Digital Minister Fahmi Fadzil said the cyber attack had the potential to cause data leakage and further investigations were underway to identify the cause of the intrusion as well as the overall impact of the incident.

"The investigating team from the Ministry of Communications and Digital which consists of the Personal Data Protection Department (JPDP) and CyberSecurity Malaysia (CSM) has begun the probe by holding discussions with the management of Capital A, which is the parent company of AirAsia, on Dec 1, 2022.

"Following the discussion, Capital A has been instructed to submit evidentiary documents along with computerised data evidence related to the investigation of this case," he said in a statement today.

However, he said the details of the case could not be disclosed to the public while the investigation was still ongoing to avoid legal implications and disrupting the investigation.


Fahmi said the ministry viewed seriously allegations that the data leak was caused by a hacker group known as 'Daixin'.

He also urged all data users to constantly monitor and improve aspects of cyber security from time to time by ensuring system infrastructure, databases and networks are updated and secure.

"Apart from that, data users should outline a cyber security policy and ensure that the policy is followed as a measure to avoid intrusion by irresponsible parties," he said.

Last month, local media reported that the personal data of passengers and employees of the low-cost airline was allegedly leaked after being hacked by a cybercrime group known as Daixin.

-- BERNAMA