In a statement, Selangkah said the data in question was not from its databases.

“Personal data stored within Selangkah databases has not been compromised and remains secure.

“The security and privacy of our users’ data remain our utmost priority. We want to reassure our users that we will continue to implement and maintain best practice measures to ensure the safety and security of our users’ data,” it said.

Selangkah was responding to claims of an unknown seller on a data leak forum offering data purportedly belonging to over five million users from its app.

According to The Star, on Feb 26, the seller claimed that the data was “related to Covid-19 vaccinations”, consisting of 10,027 files with the price listed at US$1,000 (RM4,761).

The data, allegedly from “Selangkah.my”, was said to include full names, MyKad numbers, MySejahtera IDs, ages, genders, emails, contact numbers, and medical information, as per the seller’s provided sample.

The matter is under investigation by the National Cyber Security Agency.

Launched in 2021 as a contact-tracing app during the Covid-19 pandemic, Selangkah has since transformed into an application that allows users to access a range of initiatives under the Selangor government.