The Personal Data Protection Department (PDP) has launched an investigation into Maxis after the alleged leak of content creator Khairul Aming’s personal billing information surfaced on social media.
According to NST, the probe is being conducted under the Personal Data Protection Principles and Section 130 of the Personal Data Protection Act 2010, which addresses the unlawful collection or disclosure of personal data.
The department confirmed that enforcement action would follow if any breach of the law is found.
“Every data controller must comply with the seven Personal Data Protection Principles, including ensuring customers’ personal data is protected from unauthorised access and disclosure,” PDP said in a statement.
The regulator also reminded data controllers to strengthen technical and organisational security measures, particularly around data storage infrastructure and network systems.
The investigation stems from an incident on 21 July, when Khairul Aming’s mobile billing details, including an alleged outstanding balance of RM498 and digital purchase records, were posted publicly on Threads. Malay Mail reported that the posts prompted immediate action from Communications Minister Datuk Fahmi Fadzil, who directed the Malaysian Communications and Multimedia Commission (MCMC) to obtain a full report.
Speaking at the International Regulators Conference (IRC) 2026 in Kuala Lumpur, Fahmi said the allegations suggested unauthorised individuals had accessed the telco’s internal systems. He confirmed he had already met with Maxis representatives, who indicated they were contacting Khairul Aming directly.
The minister stressed that sharing personally identifiable information without consent is a serious offence under the PDPA and urged other victims of similar leaks to lodge reports with MCMC.
Maxis previously identified the individual believed to be responsible for the leak and is pursuing legal action. The company apologised to the affected customer and maintained that there was no evidence of a wider compromise involving other subscribers.
