2026 Flexi Parking (LITS) — cyberattack; 64 councils offline; data/logs compromised

Verified cyberattack — reported 28 June–3 July 2026. Flexi Parking, the digital street-parking platform operated by Leading Innovative Technologies and Systems (LITS Sdn Bhd), went offline nationwide over the weekend of 28–30 June 2026, disrupting payments across 64 Malaysian local authorities including Selangor councils (MBSA, MBPJ, MBSJ), Kuala Lumpur City Hall, and Sabah Smart Parking integrations. Selangor local-government committee chairman Datuk Ng Suee Lim confirmed July 1, 2026 that the Flexi system was hacked and that its data and transaction logs were compromised; councils suspended parking summons enforcement during recovery. LITS publicly described an unexpected service disruption, waived parking fees during the outage, and restored core services by July 2 while investigating user reports of missing wallet credits. Threat-intelligence and local security researchers documented a defacement attributed to actor MelayuSpiritual showing root shell access and claiming a database held roughly seven million user records, citing SQL injection and unauthenticated arbitrary file upload; LITS had not published a victim count or formal data-breach notification at catalog time. PKR MP Lee Chean Chung called July 3 for Selangor to publish probe findings on scope and corrective action.