In a statement released today, the health ministry acknowledged that the personal details of patients in the registry were at risk of being exposed due to a scripting error.

“The health ministry is working with the National Cyber Security Agency (Nacsa), the Malaysian Communications and Multimedia Commission (MCMC) and CyberSecurity Malaysia (CSM) for further investigations,” the statement said.

FMT had reported earlier today that an FMT reporter was able to access identity card numbers, phone numbers, addresses and other data of more than 17,000 patients after a tip-off from an anonymous source.

The source, based in Canada, said he stumbled upon a broken link on the website when he was looking for information on Malaysian neurology patients.

He pointed to the page with the HTML scripting error. The reporter went to the page and saw the database link as well as the username and password for accessing it.

The registry is sponsored by the health ministry and was developed in 2008 by Rocket Integration Technology, a company based in Shah Alam.