Syarikat perisian didapati bertanggungjawab ceroboh, curi maklumat

The High Court in Malaysia has ruled that a software development company is responsible for hacking and stealing sensitive information from a gas company. Redzuan Idrus, a prosecutor, stated that Gas Malaysia Bhd successfully proved its case against TMS Software Sdn Bhd and its analyst, Rishveer Singh, based on the balance of probabilities.

The court also overturned a license awarded to TMS for designing automation project workflows. Compensation hearings will be held subsequently. Gas Malaysia and its subsidiary, Gas Malaysia Energy and Services Sdn Bhd, filed a lawsuit against TMS and Rishveer after discovering unauthorized access to their computer systems between February 7-14, 2024.

Approximately 621GB of data was transferred to an online storage account. Gas Malaysia obtained an order to search TMS's premises, where they found logs of unauthorized system entries, subscription management, browser history, and internal company documents. In deciding TMS responsible, Redzuan said witnesses for the defense, including Rishveer, failed to establish a convincing explanation for the log entries, browser history, cleared browsing history, and internal documents found on their premises.

The court also noted that the defense witnesses (Rishveer) were inconsistent, often changing and contradictory, and at critical points, not consistent with the existing digital records. The court found Rishveer was not a reliable witness. The court also found that the automation workflow design work for the project was carried out by a third-party contractor and not disclosed to Gas Malaysia during the relevant period.

Redzuan concluded that this concealment was intentional because the third-party's identity was not disclosed in the project management plan. "Plaintiff (Gas Malaysia) contracted the difficult technical work to be performed by the defense's personnel who were concealed using their own credentials," Redzuan said. The court found the defense responsible for a serious breach.