1.12 million break in attempts on MySejahtera

PUTRAJAYA - The audit on the Covid-19 Vaccine Registration Management and the Mysejahtera Application has found 1.12 million break in attempts on the application.

Auditor-General Datuk Seri Nik Azman Nik Abdul Majid said the minutes of the MySejahtera Security Meeting Number One 2022 referred to by the National Audit Department found the attempts used an IP address of 167.XX.XX.122.

Azman said based on the Auditor-General’s Report Series two 2021 the attempts started on Oct 27, 2021.

"A Super Admin account had downloaded the personal information of three million vaccine recipients from the MySejahtera application using several IPs.

"The audit found the company involved with the development of the application took action to take down the IP to ensure the application’s safety,” he said during a media briefing session on the Auditor General’s Report Series two 2021, on Thursday.

Azman said the application development company has installed a Web Application Firewall (Waf) via cloud on Nov 1, 2021, and continuous surveillance is done using the tool.

"The meeting chaired by the National Cyber Security Agency (Nacsa) was held on Oct 28, 2021 and suggested for follow up action to be implemented.

"The actions taken were the IP block on Oct 28, 2021 and the police report made on Nov 5, 2021, as well as researching the cause of the attack and taking steps to improve it,” he said.

He said other findings tracked a total of 1,543 individuals having two to seven MySejahtera accounts involving 3,108 IDs with active status and verified identification.

He said the registration and cancellation for the administrative management of the application is done through ‘back end scripts’.

"We found 70 individuals who have passed with active MySejahtera accounts.

"Overall, the Covid-19 Vaccine Registration Programme and MySejahtera Application were well implemented in aiding the government towards dealing with the spread of the virus,” he said.