Malaysian authorities arrested 12 individuals on July 28 for hacking the Malaysian Immigration System (MyIMMs) to fraudulently approve Temporary Employment Visit Passes (PLKS) without paying levies [1, 2, 3, 4, 5, 6, 7, 8]. The suspects include six Immigration Department personnel—four officers and two from the IT division—two company directors, three foreign nationals, and one police officer [1, 2, 3, 4, 5, 6, 7, 8].

The syndicate exploited unused PLKS quotas dating back to 2011 to issue 1,306 fake passes, costing the government an estimated RM2.4 million in losses [1, 2, 3, 4, 9, 10]. Datuk Seri Abd Halim Aman, MACC chief commissioner, said, "Initial investigations revealed that the syndicate had exploited unused PLKS quotas dating back to 2011 to issue work passes without paying the required levy" [3].

Authorities conducted raids at company premises and immigration offices in Penang and Putrajaya, seizing RM186,360 in cash, SGD 700 in foreign currency, and jewellery and gold valued at about RM15,700, along with electronic devices [6, 7, 8]. All 12 suspects, aged between their 30s and 40s, were remanded from July 29 with periods of two to three days pending further investigation [5, 6, 7, 8].

The breaches involved insider collusion using dongle devices, specialized software, and administrator login credentials to create fake accounts and approve passes [8, 9]. Immigration director-general Datuk Zakaria Shaaban said, "Penetrating the MyIMMs system from outside is not possible... In this case, it involved insiders who understood the system" [8].

Criminologist Datuk Dr P. Sundramoorthy described the incident as "a national security issue involving insider corruption and organized crime," noting, "If allegations that the system was deliberately manipulated are proven, this represents a compromise of Malaysia's border security architecture rather than simply an IT breach" [9].

The arrests were part of a joint investigation named Op Crack, initiated after intelligence sharing between the Malaysian Anti-Corruption Commission (MACC) and the Immigration Department began in May 2026 [1, 2, 7, 8]. Datuk Seri Abd Halim Aman said, "More arrests and seizures are expected as the investigation continues, with cooperation from the Immigration Department" [7].

The Immigration Department plans to cancel all fraudulently approved PLKS and track the holders to prevent them fleeing the country [11, 10]. Datuk Zakaria Shaaban added, "If they are charged in court, we will then open disciplinary proceedings and suspend them from duty until the court case is concluded" [12]. Remand periods for the suspects were set to expire from July 30 to 31, with MACC prepared to seek extensions as needed [7].