Back in 2019, over one million students and alumni from 2008 to 2018 of Universiti Teknologi Mara (UiTM) and its 13 autonomous state campuses around the country had their personal data including their names, I.C. numbers, and addresses leaked online. Data leaks can lead to identity theft, data breaches, or ransomware installation.

Now, the public university is in the limelight again for the same reasons. On 9 May, Twitter user @imraimy posted that UiTM had published a list of nearly 12k MyKad numbers and emails of applicants on an unsecured link. According to the user, who seemed to be a student from the university said that “It’s their way of letting candidates check their particulars using the browser search function from a Google sheet.


In the thread, they shared screenshots of the list with the personal details blurred out and mentioned that the particulars of a total of 11891 individuals were included on the list.


A user tagged the Twitter page of the Ministry of Communications and Digital, questioning if it was a violation of the Personal Data Protection Act 2010 (Act 709). As of March 2023, Deputy Minister Teo Ni Ching had said that so far, seven cases have been charged in court under Section 5, Act 709 with total compounds amounting to RM200,000 and eight cases under Section 16, with compounds totaling RM81,000.


Another slammed the UiTM for the issue saying that scammers pay to get this valuable info but it was released by mistake by the university.


One user said that there were only two reasons for data breaches, which was either that there were security issues or that someone on the inside had been bribed to sell the data.


The official Twitter page of UiTM later replied to the thread asking the user to DM them further about the issue. They later followed up with another Tweet saying, “We apologise for the mistake” and updated that the link to the list had been deactivated and an update had been made.


Back in 2021 in the US, a ransomware gang started leaking the private data of universities in Colorado and Miami, to attempt to coerce them to pay the ransom to stop the leaks and to delete the stolen data.

Image credit: facebook.com/uitmcmrasmi/, @imraimy