Syarikat perisian didapati bertanggungjawab ceroboh, curi maklumat

The High Court in Malaysia has ruled that a software development company is responsible for hacking into the computer systems of a gas company without authorization and stealing sensitive information. Assistant Chief Public Prosecutor Redzuan Idrus stated that Gas Malaysia Bhd successfully proved its case against TMS Software Sdn Bhd and its analyst, Rishveer Singh, based on the balance of probabilities.

The court also annulled a commendation letter given to TMS for their work on automatic workflow process automation. Compensation hearings will be conducted subsequently. Gas Malaysia and its subsidiary, Gas Malaysia Energy and Services Sdn Bhd, filed a lawsuit against TMS and Rishveer after detecting the hacking of their computer systems between January 7 and 14, 2024.

Approximately 621GB of data was transferred to a cloud storage account. Gas Malaysia obtained a search warrant for TMS' office where they found evidence of unauthorized system access, cloud subscription management, deleted browser history, and confidential Gas Malaysia documents. In deciding TMS to be responsible, Redzuan said witnesses for the defendants, including Rishveer, failed to prove their claims under Section 114A of the Evidence Act due to lack of satisfactory explanations about the discovered information.

"Defendants failed to explain the login logs, proxy management history, deleted browser history, and possession of confidential documents unrelated to the project," the judge added. The court also found that the automation workflow design work was carried out by a third-party contractor and was not disclosed to Gas Malaysia during the project.

Redzuan determined that the concealment was intentional due to the third-party contractor's identity not being disclosed in the project management plan. "The plaintiff (Gas Malaysia) contracted work to perform sensitive tasks by the defendants' personnel, but they receive the performance through hidden third parties using their own credentials," the judge stated. The court found the defendants' actions as a fundamental breach.