Personal Data Protection Department investigates Maxis over Khairul Aming data leak
PUTRAJAYA, July 22 — The Personal Data Protection Department (JPDP) has launched a probe into the unauthorised disclosure of Maxis customers’ account and billing details after the information surfaced on social media.
The department warned that it could trigger enforcement action if a breach of the law is established.
“JPDP is conducting an investigation under the Personal Data Protection Principles and Section 130 of the Personal Data Protection Act 2010 in relation to the unlawful collection or disclosure of personal data,” it said.
The department noted that appropriate penalties would follow should investigators find that the telco failed to comply with the Act.
The investigation was sparked by a controversy involving beauty entrepreneur and social media personality Khairul Aming, whose private account and billing details were leaked across social media.
The incident came to light after a user on Threads publicly claimed to know specifics of Khairul Aming’s phone bill, including an alleged outstanding balance of RM498 and details of digital purchases.
The leak prompted an immediate response from Communications Minister Datuk Fahmi Fadzil, who tasked the Malaysian Communications and Multimedia Commission (MCMC) with securing a full report.
Speaking at the International Regulators Conference (IRC) 2026 in Kuala Lumpur, Fahmi noted that allegations on Threads suggested individuals without authorisation were able to view sensitive data from the telco’s internal systems.
Fahmi has already met with company representatives, who indicated they were reaching out to Khairul Aming to address the matter.
The minister stressed that sharing personally identifiable information without consent is a serious offence under the PDPA, and he urged other victims of similar leaks to lodge reports with the MCMC to provide a proper evidentiary trail for investigators.
The JPDP reminded all data controllers that they are bound by seven core principles requiring customer data to be safeguarded against unauthorised access.
The regulator has called on companies to strengthen their technical and organisational security measures to ensure that data storage systems and networks meet adequate security standards.
