KUALA LUMPUR (Oct 7): Bank Negara Malaysia (BNM) has instructed iPay88 (M) Sdn Bhd to undertake additional measures to further strengthen the payment gateway service provider’s cybersecurity controls and IT infrastructure.
The instruction was issued after the completion of an independent forensic investigation on the company’s data breach incident recently. iPay88 has also taken the necessary containment and rectification measures to address gaps that were identified, according to the central bank.
“These measures are aimed at ensuring that similar incidents do not recur in the future and to safeguard against future threats.
“BNM will continue to closely monitor iPay88’s implementation of these measures and where appropriate, will undertake further supervisory or enforcement action,” said the central bank in a statement.
“BNM has also directed banks and card issuers to maintain heightened vigilance over activities of cards that may be at risk. Customers will be contacted if any suspicious activity is detected through the monitoring activities of their banks or card issuers,” it said.
“BNM would like to reassure members of the public that Malaysia’s banking and payment systems remain safe and secure,” it added.
Under existing payment card rules, BNM said customers will not be liable for any fraudulent or unauthorised transactions, as long as customers have taken reasonable precautions to safeguard their payment cards.
Meanwhile, iPay88 said in a separate statement that the cybersecurity incident was "the product of a sophisticated intrusion by an unidentified party or parties".
"The intrusion specifically targeted card data from online transactions. There was no impact on transactions made through the Android terminals, e-wallet QR payments, online banking, BNPL, vending machines, Point of Sale (POS) and batch card payment.
"While iPay88 was the subject of a sophisticated attack, iPay88 acknowledges that it bears the burden and responsibility to protect card information. We respectfully apologise to the Malaysian public, our business partners and merchants for this incident," it said.
It also assured the public that it takes the protection of consumer data seriously and that it has taken the necessary steps to ensure the situation was contained and all transactions through iPay88 have been fully secured.
"The containment and remedial action were successfully completed by July 20, 2022 and no further indicator of any intrusions has been detected post that date," it said.
"We would also want to reassure the Malaysian public that, substantively, Malaysian cards are protected against unlawful and fraudulent use by the 3D secure system which requires online transactions to be verified by the use of a one-time pin sent directly to cardholders.
"Separately, iPay88 is working closely together with other industry players to minimise the risks that could have arisen due to the incident," it said, adding it remains committed to investing more resources to enhance its cybersecurity to ensure protection of customer data.