Malaysia's immigration infrastructure is once again under scrutiny after authorities uncovered an alleged syndicate believed to have manipulated the Malaysian Immigration System, better known as MyIMMs, to approve Temporary Employment Visit Passes without collecting the required government levy.
The joint operation by the Malaysian Anti-Corruption Commission and the Immigration Department resulted in the arrest of 12 individuals, including Immigration personnel, private-sector representatives, foreign nationals and a police officer. Investigators estimate that the alleged scheme caused approximately RM2.4 million in losses to government revenue.
The case remains under investigation, and the individuals arrested have not been convicted. Nevertheless, the allegations raise serious questions about privileged access, internal monitoring and the security of systems responsible for managing foreign-worker permits and national immigration records.
A Joint Investigation Conducted Over Several Months
The operation was not triggered by a single unexpected alert. MACC and the Immigration Department reportedly began exchanging intelligence in May 2026 before coordinating arrests and searches in the Klang Valley, Penang and Putrajaya.
Among those detained were two company directors, three foreign nationals, four Immigration officers, two staff members from the department's Information Technology Division and one police officer. The suspects, mostly in their 30s and 40s, were taken into custody at MACC headquarters and the Penang Immigration headquarters.
The involvement of both operational and technical personnel is particularly significant. Manipulating a government database may require more than knowing a username and password. Those involved may need to understand the system's workflow, database structure, approval process and weaknesses in its monitoring controls.
Technical support for the investigation reportedly came from CyberSecurity Malaysia, Telekom Malaysia and MACC's Technology Forensics Division. Searches were also conducted at company premises and Immigration offices to secure devices, records and other potential evidence.
How the Alleged PLKS Scheme Worked
A Temporary Employment Visit Pass, or PLKS, allows an approved foreign worker to work legally in Malaysia for a specified employer, sector and period.
The process normally involves several checks and payments, including the foreign-worker levy. That levy represents revenue owed to the government and forms part of the regulatory mechanism used to manage foreign labour.
Preliminary investigations indicate that the syndicate allegedly discovered or gained access to unused PLKS quotas dating back to 2011. These dormant quotas were then believed to have been reactivated or manipulated inside MyIMMs to generate new approvals without the corresponding levy being paid.
Investigators believe approximately 1,306 questionable PLKS approvals were processed through the compromised system.
If the allegation is proven, the incident was not merely an attempt to forge a document outside the government environment. The passes appeared to have been processed through the actual immigration platform, potentially making them look legitimate when checked by employers, enforcement officers or other government systems.
Why an Approval Inside the System Is More Dangerous Than a Fake Document
A forged physical permit can sometimes be detected through visual inspection, verification or comparison with official records.
A fraudulent approval created inside the authoritative government database is much more difficult to identify.
When an officer checks the pass, the system may show an apparently valid record. The document, employer information and approval status may all appear consistent because the data originated from within the platform itself.
This is what makes insider-enabled system manipulation so dangerous. The attacker is not simply trying to imitate an official record. The attacker may be abusing the mechanism that creates the official record.
Once false data enters a trusted system, it may also be copied into connected platforms, reports and enforcement records. Correcting the problem then requires more than deleting one entry. Authorities must identify every dependent record and determine whether later transactions relied on the fraudulent approval.
The Case Appears to Be About Access, Not Only "Hacking"
The word hacking often creates an image of an unknown attacker breaking into a system remotely from another country.
This case appears more complicated.
When authorised employees, contractors or connected business parties are allegedly involved, the main issue may include abuse of legitimate access, unauthorised software, shared credentials, manipulated workflows or deliberately weakened controls.
An individual does not necessarily need to defeat every cybersecurity barrier when they already possess access to part of the environment.
This is why government systems must protect themselves against both external attackers and trusted insiders. Firewalls and antivirus protection remain necessary, but they cannot independently stop an authorised account from performing an inappropriate transaction.
Strong insider-risk controls should include separation of duties, transaction approval, privileged-access monitoring and detailed audit trails that cannot be altered by ordinary system administrators.
Dormant Quotas Should Have Triggered Additional Verification
The alleged use of unused quotas dating back to 2011 raises an important control question.
Why would an old or inactive quota remain capable of generating a new work-pass approval without an additional verification process?
Dormant records should generally be treated as higher-risk transactions. If a quota has remained unused for many years, the system should require confirmation that the original company still exists, the approval remains legally valid and the relevant levy has been paid.
A secure design could automatically flag unusual behaviour such as:
These patterns do not automatically prove corruption, but they should generate alerts for independent review.
Government Revenue Is Only One Part of the Potential Damage
The estimated RM2.4 million loss represents unpaid levies, but the wider consequences may be more serious.
Fraudulent work-pass approvals can affect labour regulation, employer accountability, immigration enforcement and national security. They may also expose foreign workers to exploitation when their legal status is tied to a company or quota that does not genuinely represent their employment.
Authorities will need to determine whether the individuals associated with the 1,306 approvals entered Malaysia, where they currently work and whether their employers knew that the records were allegedly obtained improperly.
The investigation may also need to examine:
The financial estimate may therefore increase as investigators reconstruct the full period of activity.
Privileged IT Accounts Need Stronger Oversight
The reported arrest of two staff members from the Immigration Department's IT division deserves particular attention.
Technical administrators often require powerful access to maintain servers, troubleshoot applications and support users. That access can include capabilities unavailable to normal operational staff.
However, technical privileges should not allow one person to change sensitive immigration records without detection.
Administrators should use separate accounts for ordinary work and privileged maintenance. Sensitive access should require multifactor authentication, formal approval and time-limited elevation rather than remaining permanently active.
Every privileged action should also be logged in a system that the administrator cannot modify or erase.
A proper privileged-access management environment can record:
For the most sensitive operations, session recording may also be appropriate.
Separation of Duties Is Essential
No single person should be able to create, approve and finalise a high-risk immigration transaction alone.
The person managing a quota should not also be able to approve the PLKS, alter payment status and remove the audit record. These responsibilities should be distributed among different roles.
A properly separated process could require:
Any direct database intervention should require documented emergency approval and a post-implementation review.
This may slow down exceptional transactions slightly, but it greatly reduces the possibility that one compromised account can complete an entire fraudulent process.
Audit Logs Must Be Actively Reviewed
Many systems record logs but fail to use them effectively.
Keeping millions of events is not enough when nobody reviews unusual behaviour or receives an alert when a sensitive record changes.
For an immigration platform, monitoring should connect information from several sources: application logs, database activity, administrator accounts, payment records, workstation security, network traffic and physical access.
A PLKS approval without a matching levy payment should be treated as an immediate exception. Similarly, a dormant quota suddenly producing dozens of approvals should not be allowed to blend into ordinary activity.
Monitoring should also continue after an employee changes role or leaves the department. Accounts must be removed promptly, and access rights should be reviewed regularly to ensure staff retain only what they need for their current responsibilities.
MyIMMs Has Faced Questions Before
The current allegation is not the first controversy involving MyIMMs.
In 2016, police investigated suspected sabotage of the platform after weaknesses and irregularities were identified in the system. The Auditor-General had also raised concerns about whether MyIMMs adequately supported the Immigration Department's operations.
In 2019, authorities confirmed that fraudulent foreign-worker quota approvals had been found through manipulation of MyIMMs. The Immigration Department subsequently announced plans to replace the ageing platform with a new integrated system designed to reduce manipulation and fraud.
Another major operation in 2021 resulted in arrests over allegations that devices and software had been installed to compromise immigration computers and produce fraudulent PLKS records. Immigration personnel were among those detained.
These earlier incidents do not prove the current allegations, but they demonstrate that the risks surrounding MyIMMs have been known for many years.
A Legacy Platform Carries More Than Technical Debt
MyIMMs is approximately three decades old. In May 2026, a nationwide disruption affected immigration processing at several entry points, although the Home Ministry said the incident was caused by an internal technical failure rather than a cyberattack. Officials acknowledged that disruptions could recur while the legacy platform remained in operation.
An old system is not automatically insecure. Some legacy platforms remain dependable because they are carefully maintained and isolated.
The problem arises when decades of modifications, integrations and temporary fixes make the system difficult to understand or monitor.
Legacy platforms may contain:
Replacing such a system is complex because immigration operations cannot simply be stopped while a new platform is installed. The government must migrate large volumes of sensitive data while maintaining border and permit services.
MyNIISe Must Be More Than a Modern Replacement Screen
Malaysia is now moving towards the National Integrated Immigration System, or MyNIISe.
The new platform is being introduced progressively at air, land and sea entry points, with broader implementation targeted from September 2026. It is intended to improve border clearance, identity management and the delivery of digital immigration services.
However, replacing the user interface and underlying hardware will not be enough.
MyNIISe must correct the control weaknesses that allowed suspicious records to enter earlier systems. Old accounts, flawed procedures and undocumented exceptions should not simply be transferred into the new environment.
The migration should include:
Data integrity should be verified before records are migrated. Otherwise, the new system may inherit historical manipulation from the old one.
Cybersecurity Cannot Solve a Corruption Problem by Itself
Even the strongest technical platform can be abused when several trusted people work together to defeat its controls.
Cybersecurity can make corruption harder, more visible and more expensive, but technology alone cannot replace governance and accountability.
Staff vetting, rotation of sensitive duties, whistleblower protection and independent audits remain essential. Employees must also know that high-risk transactions are actively monitored and that unexplained changes will be investigated.
At the same time, controls should not be designed around the assumption that every employee is dishonest. Excessive bureaucracy can slow legitimate services and encourage workarounds.
The objective is to create a process where ordinary work remains efficient but unusual activity becomes difficult to hide.
The Investigation Must Preserve Digital Evidence
Because the allegations involve a government information system, digital forensics will be central to the case.
Investigators may need to reconstruct activity across databases, application servers, employee workstations, mobile devices, payment systems and network records.
They will also need to establish whether a transaction was performed through the normal interface, through an administrator function or by directly modifying the database.
Important evidence may include:
Maintaining a clear chain of custody is essential so that the evidence can withstand legal scrutiny.
Arrests Do Not Equal Convictions
The case is reportedly being investigated under Sections 17(a) and 16(a) of the MACC Act 2009, which concern the giving or receiving of gratification in corruption-related offences.
The suspects were expected to appear before the Putrajaya Magistrates' Court for remand applications while investigators continued gathering evidence.
A remand order allows authorities additional time to conduct an investigation. It is not a finding of guilt.
This distinction matters because the public discussion surrounding a major government-system case can move much faster than the legal process. Conclusions should be based on verified evidence presented through the appropriate proceedings.
Final Thoughts
The alleged manipulation of MyIMMs is not merely another story about a government computer being "hacked."
It is a warning about what can happen when sensitive system access, administrative privilege, financial processing and human integrity fail at the same time.
If more than 1,300 PLKS approvals were processed using dormant quotas without the required levies, the authorities must determine not only who performed the transactions, but also why the system allowed them to occur repeatedly without triggering an effective response.
The transition to MyNIISe creates an opportunity to rebuild immigration technology around stronger identity controls, payment reconciliation, continuous monitoring and tamper-resistant records.
But a new platform alone will not solve the problem.
Malaysia also needs rigorous access governance, independent oversight and a culture in which suspicious activity is reported and investigated quickly. The real success of MyNIISe will not be measured only by faster border clearance or a more modern interface. It will be measured by whether unauthorised approvals become substantially harder to create—and almost impossible to hide.
Comments