Consumer Choice Centre said the data may be abused by certain parties.

“The ministry must come up with safety measures to prevent the theft of MySejahtera data from recurring,” said the group’s spokesman, Tarmizi Anuwar.

“It must take action immediately because after one year and three months, it still does not know or has identified the personal data fields that have been downloaded.

“This is worrying because data on more than 3 million users is at risk of being misused by those who have downloaded it.”

The Auditor-General’s Report for 2021 revealed that personal information of three million vaccine recipients was downloaded by a “super admin” account under the MyVAS system.

The data breach occurred between Oct 28 and Oct 31, 2021. The user ID of the”super admin” was deactivated in November that year.

Consumer Choice Centre said a survey conducted by the audit team revealed that 49.8% of the 2,699 respondents did not agree to their personal details being kept in MySejahtera.

“The survey shows that users are not confident with the security level of the application and they are concerned if their personal details were breached by irresponsible parties,” it said.

The MySejahtera app was launched during the height of the Covid-19 pandemic to help with the management of the virus and vaccination programme. It has since been updated to enable the public to trace other infectious diseases.