2026 LHDN (Malaysia) — MyTax portal sale claim (unverified); 10M taxpayer records alleged
Data compromised
Actor-claimed 10 million JSON taxpayer records including NRIC national ID numbers, tax identification numbers (TIN), names, dates of birth, marital status, full addresses, emails, phones, employer details, and bank account numbers on ~5.29 million rows per listing—unverified
Technical writeup
Unverified sale listing — observed July 2, 2026. Threat-intelligence reporting (Dark Web Informer) documented forum actor dezetat advertising Malaysia Inland Revenue Board (LHDN / IRBM) MyTax taxpayer data for $20,000, claiming 10 million records exfiltrated in June 2026. Alleged fields include NRIC numbers, TINs, names, dates of birth, addresses, contact details, employer metadata, and bank account numbers on roughly 5.29 million rows. No public samples or LHDN confirmation were available at catalog time. BreachHistory uses the actor-cited 10 million count labeled unverified pending company or regulator attestation.
Root cause
Unverified criminal-forum sale listing by actor dezetat claiming June 2026 exfiltration from Malaysia Inland Revenue Board MyTax portal—LHDN had not confirmed at catalog time