Malaysia’s Flexi Parking Platform Hit by Nationwide Cyberattack, Disrupting Parking Payments Malaysia’s Flexi Parking platform suffered a major cyberattack over the weekend, crippling parking payment systems across the country. The breach, attributed to a threat actor known as MelayuSpiritual, exploited two preventable vulnerabilities SQL injection and unauthenticated file uploads granting attackers root access to the platform’s servers. The incident has disrupted parking operations for all 64 local authorities using Flexi Parking, including major cities like Shah Alam, Subang Jaya, and Selayang. Selangor’s Smart Selangor Parking app, which relies on the platform, was also affected. Authorities have temporarily suspended parking enforcement while restoration efforts are underway. Cybersecurity firm Gotchaa Lab reported that the attackers may have accessed a database containing approximately 7 million user records. However, it remains unconfirmed whether data was exfiltrated or if an official investigation has been launched. In response, local councils are advising motorists to use alternative payment methods until services are restored. Flexi Parking’s operator, Suasa Efektif, has acknowledged the breach and is working to recover the system. The attack highlights persistent security gaps in critical digital infrastructure.

Flexi Parking System Breach Exposes Security Gaps in Malaysia’s Public Digital Infrastructure A cybersecurity breach in Malaysia’s Flexi Parking system has disrupted parking payment services across 64 local authorities nationwide, including the Smart Selangor platform. The incident, reported by Petaling Jaya MP Lee Chean Chung, raises concerns over potential exposure of citizens’ personal data and systemic vulnerabilities in public digital infrastructure. The breach highlights long-standing security warnings that allegedly went unaddressed, pointing to governance and risk management failures. While the immediate impact includes disrupted parking services, the broader implications involve data privacy risks and financial accountability particularly as users’ sensitive information may have been compromised. The Selangor Intelligent Parking (SIP) programme, a public-private partnership model, has faced prior scrutiny. Under this arrangement, 50% of parking revenue is diverted to private concessionaires, raising questions about whether local authorities retain adequate oversight of cybersecurity, operational standards, and vendor performance. Critics argue this model undermines public-sector digital resilience, contradicting federal efforts under GovTech to reduce reliance on external vendors and strengthen in-house capabilities. Lee has demanded full transparency, urging the Selangor government to release a comprehensive investigation report detailing the breach’s cause, scope of data exposure, financial impact, and corrective measures. If no such report is forthcoming, he has called for a public hearing by the Selangor Select Committee on Competency, Accountability, and Transparency (Selcat) to assess weaknesses and restore public trust. The incident underscores the need for stronger governance in public digital systems, where cybersecurity is not just an IT issue but a matter of public trust and accountability. As citizens increasingly rely on government-linked digital platforms for essential services, the breach serves as a critical reminder of the risks posed by unaddressed vulnerabilities and privatized infrastructure.