MTCA data leak exposes details of 7,000 companies, PN calls for Finance Minister’s accountability

The Malta Tax and Customs Administration (MTCA) has confirmed that a data breach on Tuesday afternoon exposed contact details of around 7,000 companies, after an error during a routine communication process led to the wrong file being attached to a mass email.

In a statement released on Thursday, the MTCA said the incident occurred between 1pm and 3pm on 12 November during what was supposed to be a controlled notification process via its secure portal. Instead, the established workflow was not followed, resulting in company information being sent to unintended recipients.

The file distributed contained company names, registration and tax numbers, company status, email addresses, and phone numbers. The MTCA stressed that no financial data or taxpayer records were included, and that the breach was not the result of a cyberattack or unauthorised system access.

“Immediate containment actions were taken,” the statement said, adding that an internal review has been launched to identify what went wrong and whether disciplinary or procedural action is needed.

Commissioner for Tax and Customs Joseph Caruana said new safeguards, validation steps, and oversight controls would be introduced to prevent a repeat of the incident.

The Office of the Information and Data Protection Commissioner (OIDPC) has been officially notified of the breach, in line with data protection requirements.

PN: “Systemic failure, not a simple mistake”

In a statement issued on Thursday afternoon, the PN accused Finance Minister Clyde Caruana of failing to ensure proper data safeguards within his ministry and said he must take political responsibility for the incident.

“When such a volume of sensitive information ends up in the wrong hands, it is not the result of an individual mistake but evidence of systemic failures,” the PN said.

The Opposition also disputed the government’s initial messaging, saying the breach affected far more than a single company and involved details of thousands of businesses and private individuals linked to them.

The PN is demanding that Caruana publish all the facts, launch an independent investigation separate from the MTCA’s internal review, and present a clear plan to restore public trust in how taxpayer and business data is handled.

“The public has a right to know what happened to their information and what remedies are being offered,” the party said.