When a Cybersecurity Breach Involves Your IT Service Provider And Its Employee: Who Bears the Legal Liability?

Can an IT service provider and its employee be held liable when its employee compromises a client’s computer systems and confidential business information?

In Gas Malaysia Energy and Services Sdn Bhd & Anor v Rishveer Singh Jaswant Singh & Anor [2026] CLJU 3384, the High Court examined the civil liability arising from a cybersecurity breach involving an IT service provider and its employee, where approximately 621GB of corporate data was exfiltrated.

The decision highlights several important legal principles, including implied confidentiality obligations in commercial IT contracts, vicarious liability, breach of confidence and unlawful interference with trade. It also serves as a reminder that businesses must exercise care when granting external service providers access to their computer systems and confidential information.

Can Your Business Bank Account Become Part Of A Money-Laundering Investigation Because Of Someone Else’s Cybercrime?

Your business could face scrutiny if funds linked to cybercrime pass through its bank account, even if you were unaware of the underlying criminal activity. From suspicious third-party payments to unexpected transfers, seemingly ordinary business transactions can expose your company to financial and legal risks.

Learn how to identify red flags, protect your business, and respond appropriately to suspicious transactions before they escalate into a money-laundering investigation.