2026 Malaysia LHDN (MyTax) — dezetat sale claim (unverified); 10M taxpayer records alleged
Data compromised
Actor-claimed JSON repository with NRIC numbers, tax IDs (TIN), names, dates of birth, marital status, addresses, emails, phones, MyTax security phrases, bank account numbers (~5.29M alleged), employer data, and tax-filing history—unverified
Technical writeup
Unverified sale claim — indexed July 2–3, 2026. Threat-intelligence monitoring reported actor dezetat advertising a $20,000 sale of what they describe as 10 million taxpayer records exfiltrated in June 2026 from Malaysia's Inland Revenue Board (LHDN/IRBM) MyTax portal, including NRIC national ID numbers, tax numbers, contact details, MyTax security phrases, bank account numbers for roughly 5.29 million records, and tax-filing metadata. Dark Web Informer and VECERTRadar summarized the listing; neither LHDN nor MyCERT had issued forensic confirmation at catalog time. BreachHistory uses the actor-cited 10M figure labeled unverified in title and writeup pending Malaysian authority confirmation.
Root cause
Unverified dark-web sale listing by actor dezetat claiming exfiltration of MyTax portal database from Malaysia's Inland Revenue Board (LHDN/IRBM)—agency had not confirmed at catalog time