Star Media Group, the Malaysian publisher of The Star newspaper, has confirmed a data breach in which attackers stole personal information, including Malaysian identity card numbers and encrypted account passwords, from two of its databases. The company says the personal data was exfiltrated on 27 October 2026 and the incident was publicly disclosed on 5 November.

The breach affected the company's StarSearch classifieds database and its ESG Awards database. From StarSearch, the attackers took first and last names, addresses, states, countries, telephone numbers, email addresses and NRIC numbers, the Malaysian national identity card number. From the ESG Awards database, they took first and last names, mobile telephone numbers, email addresses and passwords. Star Media Group says the ESG Awards passwords were stored in encrypted form, although it has not disclosed the encryption method used.

The company says the two affected databases did not contain bank account numbers or payment card information, so no banking details were exposed. It has not disclosed how many people were affected or how much personal information was stolen in total. The main TheStar.com.my subscriber database and its news subscription accounts have not been identified as affected.

Star Media Group says its investigation indicates the attackers exploited a vulnerability in one of its applications to gain unauthorised access. The company confirmed the exfiltration of personal data on 27 October and notified Malaysia's Personal Data Protection Commissioner on 30 October. It began notifying affected individuals on 4 November and has set up a dedicated help centre where people can check whether their email address was affected.

The company says it has filed a Data Breach Notification with the Commissioner of Personal Data Protection under Section 12B of the Personal Data Protection Act, and has also filed a police report with the Royal Malaysian Police. The investigation is continuing, those responsible have not been identified, and as of the company's update on 5 November no ransom demand or other demand had been received in connection with the incident.

Star Media Group says it has contained the incident, engaged independent cybersecurity specialists, strengthened its security controls and enhanced its monitoring. It is also strengthening access controls and authentication, applying security updates and carrying out an independent review of the affected systems.

All affected ESG Awards users are being required to reset their account passwords as a precaution. The company advises anyone who used the same password on other online accounts to change those as well, to use strong unique passwords for each account and to enable two-factor authentication wherever it is available. It warns that the stolen details could be misused for phishing, scams or identity fraud, and that it will never ask anyone to disclose account passwords, banking one-time passwords or credit card numbers in connection with the breach. A dedicated support email and hotline, 1300 88 7827, have been set up for affected individuals.