Listen to this Post
Introduction
Tax databases are among the most sensitive digital assets maintained by any government. They contain financial histories, personal identifiers, banking information, and records that can be exploited for identity theft and sophisticated financial fraud. When claims emerge on underground cybercrime forums alleging the theft of national tax records, they immediately attract the attention of security researchers, governments, and threat intelligence analysts worldwide.
A recent post circulating within the cyber threat intelligence community claims that a threat actor is attempting to sell an alleged database belonging to Malaysia’s Inland Revenue Board (IRBM), also known as LHDN, through the MyTax portal. While the claims have generated concern, there is currently no independent verification confirming that the advertised dataset is genuine or that Malaysia’s tax infrastructure has been compromised.
Alleged Sale of
A cybercriminal has allegedly listed a database for sale that is claimed to originate from Malaysia’s Inland Revenue Board (IRBM/LHDN). According to the advertisement, the data was supposedly exfiltrated during June 2026 before being offered for sale on a dark web marketplace.
The individual behind the listing is requesting $20,000 for what is described as a massive collection of taxpayer information affecting more than 10 million records.
At the time of publication, neither Malaysian authorities nor independent cybersecurity researchers have confirmed the authenticity of the claimed breach.
What the Seller Claims the Database Contains
According to the advertisement, the alleged database includes an extensive collection of taxpayer information.
The claimed contents include:
More than 10 million taxpayer records
Tax Identification Numbers (TINs)
Personal profile information
Tax filing history
Tax payment records
Bank account information
Email addresses
Telephone numbers
JSON-formatted structured database files
If genuine, such information would represent one of the most comprehensive financial datasets available to cybercriminals.
However, these remain unverified claims originating from a threat actor seeking financial gain.
Why Tax Databases Are Highly Valuable to Cybercriminals
Unlike ordinary data breaches that expose usernames or passwords, tax databases provide long-term identity information that cannot easily be changed.
Taxpayer identifiers often remain valid for decades, making them attractive targets for criminal organizations.
Financial criminals frequently use tax information for multiple illegal activities including:
Identity theft
Tax refund fraud
Loan application fraud
Account takeover attempts
Banking scams
Social engineering campaigns
Highly personalized phishing attacks
Because tax records usually combine government-issued identifiers with financial history and contact information, they dramatically increase the success rate of targeted attacks.
No Independent Verification Exists
One of the most important aspects of this incident is the lack of independent confirmation.
The advertisement itself originates from a threat actor operating within cybercriminal circles. Such individuals frequently exaggerate, recycle previously leaked databases, or falsely advertise datasets to attract buyers.
Without technical verification, sample validation, official government acknowledgement, or forensic analysis, there is no evidence confirming that the advertised information actually originated from Malaysia’s MyTax system.
Responsible reporting therefore requires treating these claims as allegations rather than confirmed facts.
Potential Risks if the Claims Become Verified
Should investigators eventually confirm the authenticity of the alleged database, the consequences could be significant.
Millions of taxpayers could face increased exposure to identity fraud, particularly if attackers combine tax records with information obtained from previous breaches.
Financial institutions may also become targets through social engineering attacks using authentic taxpayer information.
Government agencies could experience increased phishing campaigns impersonating tax authorities, encouraging victims to disclose passwords, verification codes, or banking credentials.
Large-scale exposure of taxpayer data may also undermine public confidence in digital government services.
The Growing Underground Market for Government Data
Government databases continue to command exceptionally high prices within underground marketplaces.
Unlike stolen credit cards, which expire quickly, official government records often retain their value for many years.
Threat actors increasingly focus on acquiring:
National identity records
Passport databases
Healthcare information
Taxpayer records
Immigration databases
Government employee credentials
Such information supports long-term criminal operations ranging from identity fraud to espionage and financial crime.
Even when advertised prices appear relatively modest, cybercriminal groups may earn significantly more by reselling the same dataset multiple times.
How Organizations Typically Verify Such Claims
When an alleged government breach appears online, cybersecurity investigators generally follow a structured verification process.
They analyze sample records, examine metadata, compare data formatting with known government systems, inspect timestamps, identify duplicated information, and evaluate whether the records contain information unavailable in previous public breaches.
Investigators also determine whether the seller has an established reputation within underground communities or has previously sold authentic databases.
Only after technical validation can researchers determine whether a breach is genuine, partially authentic, recycled, or entirely fabricated.
Why Citizens Should Remain Alert
Regardless of whether this specific claim proves authentic, cybersecurity awareness remains essential.
Citizens should remain cautious when receiving unexpected emails, SMS messages, or phone calls claiming to originate from tax authorities.
Attackers often exploit media coverage surrounding alleged breaches by launching phishing campaigns designed to harvest passwords or financial information.
Users should avoid opening suspicious attachments, verify official communications directly through government websites, and enable multi-factor authentication whenever available.
Remaining vigilant significantly reduces the likelihood of becoming a victim of follow-up attacks.
Deep Analysis: Technical Perspective with Linux Security Commands
Government tax infrastructures are attractive targets because they centralize sensitive financial information under a single platform. From a defensive perspective, protecting such environments requires continuous monitoring, strict access controls, and rapid incident response.
Security teams typically begin investigations by reviewing authentication logs for unusual access patterns.
Administrators inspect web server activity:
journalctl -u nginx
Review recent authentication events:
last
Check failed login attempts:
lastb
Search authentication logs:
grep "Failed password" /var/log/auth.log
Inspect running services:
systemctl list-units --type=service
Identify suspicious network connections:
ss -tulpn
Review active processes:
ps aux
Detect recently modified files:
find / -mtime -2
Calculate file integrity hashes:
sha256sum filename
Search for newly created accounts:
cat /etc/passwd
Review sudo activity:
grep sudo /var/log/auth.log
Inspect cron jobs:
crontab -l
Monitor system events:
dmesg
Review firewall rules:
iptables -L
Capture network traffic:
tcpdump -i eth0
Analyze open files:
lsof
Inspect established sessions:
who
Check disk usage anomalies:
du -sh /
Review package modifications:
rpm -Va
or
debsums
Examine suspicious binaries:
file suspicious_binary
Generate forensic timeline data:
stat filename
Search Indicators of Compromise:
grep -Ri "malware" /var/log
Verify DNS resolution:
dig domain.com
Inspect TLS certificates:
openssl s_client -connect host:443
Security investigations rarely rely on a single indicator. Instead, analysts correlate authentication logs, endpoint telemetry, network captures, threat intelligence feeds, endpoint detection alerts, cloud logs, and database audit trails before confirming a compromise. This layered approach minimizes false positives and helps distinguish genuine intrusions from misleading claims or recycled breach data circulating on underground forums.
What Undercode Say:
The alleged MyTax advertisement reflects a broader trend in today’s cybercrime economy, where government databases have become premium commodities rather than isolated hacking trophies.
One important observation is that the asking price of $20,000 is relatively low compared to the potential criminal value of a dataset allegedly containing over ten million taxpayer records. This could indicate several possibilities. The seller may be attempting a quick sale, may possess only partial data, may be reselling previously leaked information, or may not possess the data at all.
Threat actors frequently leverage high-profile government names to gain credibility within underground marketplaces. Experienced buyers generally demand sample verification before making purchases because fraudulent listings remain common across dark web forums.
Another notable point is the claimed JSON formatting. Structured JSON exports often suggest data extracted directly from web applications or APIs rather than manually compiled spreadsheets. Nevertheless, JSON formatting alone does not prove authenticity, as fabricated datasets can easily be structured in similar ways.
Tax information remains particularly dangerous because it connects multiple identity layers. Unlike passwords that can be reset, taxpayer identification numbers, financial histories, and personal records often remain valid for years. Criminals can combine such data with information from previous breaches to build highly detailed victim profiles.
If authentic, the dataset could support phishing campaigns that appear unusually convincing. Victims are more likely to trust communications that reference genuine filing dates, payment histories, or taxpayer identifiers.
Government agencies worldwide continue accelerating digital transformation to improve citizen services. While these initiatives provide convenience, they also increase the concentration of sensitive information behind internet-facing applications, making secure software development and continuous monitoring more important than ever.
Organizations should avoid reacting solely to social media reports. Proper incident response requires forensic validation, infrastructure analysis, database auditing, and coordinated public communication. Premature conclusions may create unnecessary panic or damage public trust.
For ordinary users, this incident serves as another reminder that cybercriminals routinely exploit headlines. Even if the advertised data proves fake, phishing campaigns impersonating tax authorities often emerge after such claims become public.
From an intelligence perspective, monitoring underground marketplaces remains valuable because many confirmed breaches first appeared as anonymous advertisements before official disclosures. However, history also shows countless cases where sellers exaggerated their claims or attempted to profit from recycled datasets.
Until credible forensic evidence emerges, the reported MyTax listing should be viewed as an unverified dark web claim rather than confirmation of a successful compromise.
✅ A threat actor publicly claimed to be selling an alleged Malaysia IRBM/LHDN MyTax database containing over 10 million records.
✅ At the time of writing, there is no independent verification confirming the authenticity of the advertised dataset or that Malaysia’s Inland Revenue Board experienced a breach.
✅ Cybersecurity experts widely agree that authentic tax records would represent highly valuable assets for cybercriminals due to their usefulness in identity theft, financial fraud, and targeted phishing operations.
Prediction
(+1) Governments are expected to further strengthen tax platform monitoring, incident response capabilities, and identity protection measures as awareness of attacks targeting public-sector databases continues to grow.
(-1) Threat actors will likely continue advertising alleged government datasets on underground forums, increasing the difficulty of distinguishing genuine breaches from fabricated or recycled data while fueling phishing campaigns that exploit public concern.
▶️ Related Video (60% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
