Bahasa Melayu← Malaysia Cyber Watch
Flexi Parking knocked offline by a cyberattack
An intruder reached a legacy Flexi Parking server on 29 June 2026, and payments and enforcement stopped for 61 hours in 64 local councils. The developer, LITS, rebuilt its systems and disputes the attacker's claim of data on seven million users.
Key facts
- OrganisationLeading Innovative Technologies & Systems Sdn Bhd (LITS), developer of Flexi Parking, Smart Selangor Parking and Sabah Smart Parking. The system is used by 64 local councils across Malaysia.
- What happenedAn attacker reached a legacy server at about 9am on 29 June, sent unauthorised app notifications and defaced a council enforcement page. LITS saw databases being deleted and shut everything down.
- Data or systems affectedParking payments, compound payments and enforcement stopped from 29 June to 2 July, a 61-hour outage. Preliminary log checks found attempts to delete databases and tables, says LITS.
- Cause or entry pointLITS says folder permissions were left open during a server migration on 28 June. It says credentials and a security key left on the server for file transfers probably let the intruder in.
- ClaimedThe attacker claimed access to data on seven million users. LITS disputes this. It says the figure likely came from a login table of user IDs and timestamps, with no names, emails, IC numbers or passwords, and preliminary checks show no data was viewed or downloaded.
- AuthoritiesThe incident was referred to NACSA and MCMC. CyberSecurity Malaysia is carrying out a post-mortem. Councils were told to hold off on parking summonses during the outage.
Timeline
- 29 Jun 2026An intruder reaches a legacy LITS server at about 9am. LITS shuts down its systems. The Star
- 30 Jun 2026Motorists cannot pay for parking through Flexi Parking and Smart Selangor Parking. The Star · Malay Mail
- 1 Jul 2026Selangor's local government chairman Ng Suee Lim confirms the system was hacked and asks councils not to issue parking compounds until it works again. Malay Mail · New Straits Times
- 2 Jul 2026Services in Selangor and Sabah are restored, with payments and enforcement back to normal. The Star
- 30 Jul 2026LITS explains the breach, says it rebuilt its servers and network, and disputes the seven million user claim. The Star
Incident record
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedFlexi Parking (LITS), 64 local councilsVia a vendor | 29 Jun 2026 | Other | Intrusion | None | Confirmed. The Selangor government confirmed a cyberattack on the Flexi Parking system and told councils to suspend summonses, and LITS said an intruder reached a legacy server and caused a 61-hour outage. Claimed. The attacker claimed access to data on seven million users, which LITS disputes. | The Star (StarMetro) · Malay Mail✓ 7 Nov |
What to do
- Check your Flexi Parking or Smart Selangor Parking balance, and contact LITS through the app if credits are missing.
- If you got a parking compound between 29 June and 2 July 2026, ask the issuing council whether it will be reviewed or cancelled.
- Ignore unexpected notifications or links claiming to be from the parking app, and use only the official app.
- If you lose money to a scam linked to the incident, call the NSRC hotline on 997. Report suspicious messages to CyberSecurity Malaysia's Cyber999.
FAQ
Was Flexi Parking hacked?
Yes. The Selangor government confirmed the cyberattack, and LITS says an intruder reached a legacy server on 29 June 2026.
Was my Flexi Parking data stolen?
The attacker claims data on seven million users. LITS disputes this and says preliminary checks found no evidence that user data was viewed or downloaded, pending CyberSecurity Malaysia's post-mortem.
Do I have to pay parking compounds issued during the outage?
Selangor asked councils not to issue compounds while the system was down. Ask the council that issued yours whether it will be reviewed.
Related stories
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
- Rakuten Trade halts Bursa trading after a cyber attempt Malaysia · 30 Oct 2026
- Tabung Haji suspends all services after a cyberattack Malaysia · 8 Oct 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0