The breach was originally reported by local technology website Lowyat.net after unidentified individuals offered the phone data, from several telecoms companies, and other personal information for sale on a public forum on the site.
Communications Minister Salleh Said Keruak said police and the country's internet regulator were looking into the case.
"We have identified several potential sources of the leak and we should be able to complete the probe soon," he told reporters in parliament.
Lowyat.net removed the leaked data after getting a tip- off in mid-October. The data was from 46.2 million phone subscribers and included addresses and identity card numbers.
More From This Section
"We are also aware that the same data is being peddled across a number of other online channels," Lowyat.net wrote in a post when it originally reported the breach.
Malaysia has a population of about 32 million.
But many people have several phone numbers and The Star newspaper reported that the leaked list was believed to include inactive numbers and temporary ones used by foreigners.