This page has no affiliate links. If we add any later, they will be marked and will never change our rankings. How we make money
Cyber attacks and data breaches in Malaysia, 2026
Last checked: 9 November 2026
Large organisations make the news, but the same attacks hit small businesses every day: stolen passwords, fake invoices, ransomware and leaked customer data. Use this list to see what is happening, then check your own basics with our email check and website check.
11 incidents listed
9 confirmed by the victim or an authority
Checked on 9 November 2026
What these incidents mean for your business
What the incidents on this page have in common, and the step that protects a small business:
Your suppliers are part of your security. In 4 of these incidents the problem was at a supplier: a reservation system, a website contractor, an app developer or a trading-system vendor. Ask the companies that handle your data or systems how they protect it, and put it in writing. The PDPA checklist covers this.
Know what personal data you hold and protect it. A breach can trigger PDPA duties, including notifying the Commissioner within 72 hours. See the PDPA security checklist.
Keep your website software updated. The government websites on this page were hacked through a flaw in a website add-on. Update your website software and plugins promptly, and run the website security check.
November 2026
DefacementConfirmed
Bank Rakyat Finance
Several Bank Rakyat web pages, including its online banking login page, were defaced late on 6 November, and the bank took most of its websites offline. The Communications Minister said the hack only changed the appearance of a website managed by a third party, and no data was stolen. A group claimed it also reached internal systems; that claim is not verified.
Malaysia Airlines (through its reservation provider, Amadeus) Aviation
Malaysia Airlines said some customer information processed by Amadeus, its third-party reservation provider, between August 2023 and September 2026 may have been affected. The airline said its own systems were not compromised and it had no evidence that financial information was accessed.
Rakuten Trade's online trading of Bursa Malaysia shares was down for more than a week after the broker limited transactions as a precaution against a detected cyber security attempt. The CEO said there was no evidence of data loss. Trading resumed on its mobile app on 4 November while the web platform stayed suspended.
In a Bursa Malaysia filing, CTOS said someone gained unauthorised access to a system supporting its consumer business, and files holding a limited part of consumer information were accessed. Some credit report services were taken offline. CTOS later estimated a RM16 million revenue loss for 2026.
A cyber attack on the port's systems late on 9 September paused terminal operations for several hours. The port said it found no evidence of unauthorised access to customer data. Some reports called it ransomware, but the port has not confirmed that.
A customer's account and billing details were disclosed without authorisation and appeared on social media. The Personal Data Protection Department (JPDP) opened an investigation under the PDPA.
Flexi Parking app (used by 64 local councils) Local government
A cyber attack took the Flexi Parking app offline across 64 local councils for about two to three days from 29 June, stopping parking payments and enforcement. The developer's early review found no evidence that user data was viewed or downloaded, and it disputes the attacker's claim about the number of users affected.
Ministry of Health and three other government agencies Government
NACSA said four government websites were hacked, believed to be through a flaw in an editor extension for the Joomla website software, and urged every site owner using it to update at once.
Bank Negara Malaysia fined Bank Rakyat RM1 million after an outside attacker gained unauthorised access to its IT systems. The central bank cited weak cyber security controls and incident response. The penalty was imposed in January and announced on 1 April.
Several stockbrokers, including Malacca Securities Finance (stockbroking)
Bursa Malaysia said several brokers reported cyber security incidents in a system component, which were contained. It found no unauthorised trading or financial loss. Malacca Securities later paused trading of Malaysian shares for a security review linked to a third-party order system.
Ministry of Defence and other ministries (alleged) Government
An attacker claimed on a dark web forum to be selling databases linked to several ministries, including data on about 14,800 army personnel. The Communications Minister said no official report had been received. The claim is not verified.
We include hacking, ransomware, data breaches, defacements and DDoS attacks against Malaysian organisations that were reported by mainstream media or in an official statement.
We only repeat what the sources say. An attacker's claim is labelled as a claim until the organisation or an authority confirms it.
Dates are when the incident was first reported, unless the source gives the date it happened.
Something missing or wrong? Tell us through the contact page and we will correct it.
If your business has been hit, report it to MyCERT (Cyber999) and, for scams, call the NSRC on 997. See what to do after a scam.