Malaysia Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Malaysia
Background readingHacktivismIncident response
Medium
Only Low and Medium have been named publicly.
Raised as a precaution over regional and international tensions. No attack was announced with it.
- Critical infrastructure (NCII) operators apply nine preparedness measures, including 24-hour monitoring, patching, MFA and updated continuity plans.
- NCII sector heads file weekly threat status reports to NACSA.
- NC4 issued eight alerts and advisories on NCII and government vulnerabilities in October 2026.
NACSA, announced by the National Security Council. Source: Bernama
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
| Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyber999 incidents, Q3 2025 (total 2,020): fraud 1,521, intrusion 173, data breach 142, intrusion attempt 78, malicious code 63, vulnerability reports 17, spam 16, DoS 10 | 2,020 | Q3 2025 | MyCERT SR-033.042026 |
| Cyber999 incidents, Q4 2025 (total 1,881): fraud 1,471, data breach 171, intrusion 101, intrusion attempt 73, malicious code 40, spam 13, vulnerability reports 10, DoS 2 | 1,881 | Q4 2025 (report dated 11 April 2026) | MyCERT SR-033.042026 |
| Ransomware incidents reported to MyCERT, Q4 2025 (Qilin 2; Loki Locker, QuickLock, BitLocker, DireWolf, Enzo, NasLock 1 each; 1 unidentified) | 9 | Q4 2025 | MyCERT SR-033.042026 |
| Cyber999 incidents, Q1 2026 (total 2,188): fraud 1,829, data breach 124, intrusion attempt 81, intrusion 64, spam 31, malicious code 28, vulnerability reports 26, DoS 5 | 2,188 | Q1 2026 | CyberSecurity Malaysia, Q1 2026 Cyber Incident Summary Report |
| Cyber999 incidents, Q2 2026 (total 2,715, up 24.09%): fraud 2,314, data breach 175, intrusion attempt 91, intrusion 51, malicious code 34, spam 32, vulnerability reports 17, DoS 1 | 2,715 | Q2 2026 (published 2 September 2026) | CyberSecurity Malaysia, Q2 2026 Cyber Incident Summary Report |
| Losses reported to NSRC 997 hotline (468,675 calls) | RM1.2 billion | 12 October 2022 to August 2026 | Malay Mail (Home Minister in Dewan Rakyat, 27 Oct 2026) |
| Scam money returned to victims by NSRC / losses prevented | RM14.3 million returned; RM100.93 million prevented | October 2022 to September 2026 | Malay Mail |
| Anti-scam raids and arrests | 968 raids, 7,262 arrests | 2024 to September 2026 | The Vibes (Home Minister) |
| E-commerce scam losses | Over RM430 million | Q1 2026 | The Edge Malaysia (Minister Armizan Mohd Ali) |
| QR code scam cases and losses (CCID) | 5,134 cases, RM28.67 million | January to June 2026 | The Star |
| Online fraud charges filed (2025 full year: 6,140) | 8,014 charges; 10,245 arrests | 2026 to May | The Star (Deputy PM Zahid in Dewan Negara) |
| Attempted fraudulent transactions blocked by the financial sector (RM1.2 billion in all of 2025); about 95% of online fraud cases involved victims transferring funds themselves | RM1.9 billion | H1 2026 | Media Selangor / Bernama (BNM Governor, 6 Oct 2026) |
| BNM penalty on Bank Rakyat for RMiT and customer information breaches after external intrusion | RM1 million (imposed 20 Jan 2026, paid 26 Jan 2026) | 2026 | The Star |
| NC4 alerts and advisories on vulnerabilities affecting NCII entities and government agencies | 8 | October 2026 | Bernama |
| National Cyber Threat Level | Medium (raised from Low on 4 Nov 2026; still Medium on 7 Nov) | November 2026 | Bernama |
| Compromised government and university hosts serving gambling SEO spam (vendor count quoted by Malaysiakini) | 83 | October 2026 | Malaysiakini (Syntx Sdn Bhd figure) |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | Listed Malaysia Airlines, PLUS, Omesti, Lam Soon, Kerjaya Prospek, Kontena Nasional, MP Alor Gajah, PNSB Insurance Brokers, Sunway, CareClinics, Pengurusan Aset Air and Astino in 2026, and was the top variant in MyCERT's Q4 2025 count. | ransomware.live Malaysia · MyCERT SR-033.042026 | Profile |
| The Gentlemen | Ransomware | Listed PLUS, WCT, Kontena Nasional, KTMB, UiTM Holdings, SGS Malaysia, the Malaysian Nuclear Agency and EP Manufacturing between February and August 2026. | ransomware.live Malaysia | Profile |
| DireWolf | Ransomware | Listed Bina Darulaman, Sunzen Biotech, Perdana Petroleum and Chemsain Konsultant in January 2026 and Port of Tanjung Pelepas in September. | ransomware.live Malaysia | Profile |
| Payload | Ransomware | Listed MyIPO (myipo.gov.my) in June 2026 plus Villea Hotels and a group of manufacturing domains in May. | ransomware.live | Profile |
| Lamashtu | Ransomware | Listed several Malaysian firms from April to May 2026 including Malaysian NPK Fertilizer, Jesin Group and MSC Group. | ransomware.live Malaysia | |
| Orova | Ransomware | Listed MARDEC, Alfameli Group, Wah Chan Consolidated and Bright Property Service in October and November 2026. | ransomware.live Malaysia | Profile |
| Obscura | Ransomware | Listed telco REDtone in January 2026. | ransomware.live | |
| LockBit 5 | Ransomware | Listed OCK Group in October 2026. | ransomware.live | Profile |
| ShinyHunters | Extortion | Claimed more than 40 GB from the University of Nottingham records system covering its Malaysia campus in June 2026. | Free Malaysia Today | Profile |
| 0APT | Extortion | Claimed a 1.5 TB leak from Prince Court Medical Centre in February 2026. | Breachsense | |
| Ashborn | Unattributed | Offered Malaysian Army personnel records and MINDEF, KDN, KPT, MARA and GITN databases on a cybercrime forum in February 2026. | Lowyat.NET | |
| Mushr00w | Hacktivist | Left its name on the defaced Health Ministry homepage in the June 2026 Joomla extension wave that NACSA confirmed. | The Star | |
| MARLANWG | Unattributed | Defaced Bank Rakyat's third-party-managed website in November 2026 and claims internal access and sample data, which the bank has not confirmed. | Focus Malaysia · The Star | Profile |
| Leakers$ (also reported as LeakersGov) | Hacktivist | Claimed the October 2026 hijack of Kluang council LED screens, saying it exploited LED content software to expose weak security. | SAYS | |
| TGR-STA-1030 | State-aligned | Named by Unit 42 as a state-aligned Asian group that compromised Malaysian ministries and a microloan lender for immigration and economic data, which NACSA is investigating. | The Star | |
| Unnamed China-linked APT | State-aligned | AhnLab reported document-based attacks on government agencies in the region alongside hacktivist defacements centred in Malaysia in June 2026. | AhnLab ASEC | |
| C3RB3R | Ransomware | A Cerber-family variant that MyCERT warned on 7 November 2026 is mass-encrypting internet-exposed Synology NAS devices, renaming files with .L0CK3D and leaving read-me3.txt notes; no decryptor exists. | MyCERT MA-1500.112026 |
Laws and rules this year
- 4 Nov 2026NACSA nine mandatory preparedness measures for NCII entities. With the threat level raised to Medium, all NCII entities must apply nine measures including 24-hour monitoring, patching, MFA and updated service continuity plans, and sector heads must send NACSA weekly threat status reports. Source
- 25 Sep 2026BNM revised RMiT policy document with NCII Code of Practice. BNM reissued RMiT (superseding the June 2023 version) with a NACSA-endorsed Code of Practice for designated banking and finance NCII entities that prevails over general RMiT where they conflict, plus stronger third-party and cyber risk requirements. Source
- 20 Jul 2026Cybercrimes Bill 2026 passed by Parliament. The bill, passed by the Dewan Rakyat on 1 July and the Dewan Negara on 20 July, repeals the Computer Crimes Act 1997 and adds offences including identity theft, NDID credential misuse, AI-manipulated content used in crime and intimate image dissemination, with heavier penalties where NCII is involved. Source
- 1 Jul 2026NACSA cyber security service provider licensing forms. NACSA's licensing portal states new, renewal and resubmitted applications for managed SOC and penetration testing licences must use the latest Forms A, B and C from 1 July 2026. Source
- 1 Jun 2026ONSA Child Protection Code and Risk Mitigation Code effective. MCMC published both codes on 22 May 2026, effective 1 June, requiring child safety by design, safeguards limiting account registration by under-16s, risk assessments, advertiser verification and labelling of manipulated content. Source
- 12 Mar 2026Bursa Malaysia review of broker IT Security Standards. Bursa said it is reviewing its IT Security Standards for brokers including vendor oversight, with the enhanced framework targeted for Q4 2026. Source
- 1 Jan 2026Online Safety Act 2025 in force. ONSA took effect for ASP, CASP and NSP licensees, and the CMA 1998 s46A deeming provision brought social media platforms meeting the licensing criteria under the licensing framework. Source
- 1 Jun 2025PDPA amendment phase 3 (before the window, still the current baseline). Mandatory DPO appointment (s12), breach notification to the Commissioner and to affected people where significant harm is likely (s12B), and data portability (s43A) took effect in June 2025; no transmission period for portability has been prescribed. Source
Full stories
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- Amadeus airline data breach Malaysia, Singapore, Japan +3 · 4 Nov 2026
- Rakuten Trade halts Bursa trading after a cyber attempt Malaysia · 30 Oct 2026
- Tabung Haji suspends all services after a cyberattack Malaysia · 8 Oct 2026
- Port of Tanjung Pelepas halted by a cyber incident Malaysia · 10 Sep 2026
- Flexi Parking knocked offline by a cyberattack Malaysia · 29 Jun 2026
Official statements
- 7 Nov 2026NACSA says it is aware of incidents at several financial institutions and the situation is under control. None named. The Star
- 7 Nov 2026Fahmi Fadzil says non-state actors attempted attacks but no data theft or online banking disruption has occurred, and Bank Rakyat's case was a defacement. The Star
- 7 Nov 2026Miri police receive four reports of failed ATM cash withdrawals and are checking whether a cyberattack or a technical fault caused them. Utusan Sarawak
- 7 Nov 2026MyCERT advisory MA-1500.112026 rates the risk critical for Synology NAS owners: a C3RB3R ransomware wave is mass-encrypting internet-exposed devices through unpatched DSM flaws (CVE-2024-10441), and the Node2Shell Brotli flaw (CVE-2026-111497) is under investigation as another way in. Patch or reinstall within 24 to 48 hours. MyCERT
- 7 Nov 2026MKN warns the public against unverified cyberattack claims on social media, keeps the threat level at Medium and says BNM leads financial-sector preparedness. FMT
- 6 Nov 2026MCMC steps up monitoring; Bank Negara restates RMiT duties; Cabinet orders a review of government, bank and GLC systems. The Star
- 5 Nov 2026NACSA tells users to turn off WhatsApp and Telegram auto-download after .vbs files disguised as financial and legal documents spread via WhatsApp Web. RTM
- 4 Nov 2026NACSA raises the national threat level from Low to Medium. Bernama
- 3 Nov 2026PM Anwar tells Parliament Malaysia could be targeted, citing data centres and its stance on Palestine and Gaza. Malay Mail
- 27 Oct 2026Home Minister tells the Dewan Rakyat NSRC recovered only RM14.3 million of RM1.2 billion in reported scam losses. Malay Mail
- 19 Oct 2026NACSA chief Megat Zuhairy says most SEO poisoning incidents on government sites can be mitigated promptly. Malaysiakini
- 6 Oct 2026BNM Governor says the financial sector blocked RM1.9 billion in attempted fraud in H1 2026. Media Selangor / Bernama
- 25 Sep 2026BNM reissues RMiT with a NACSA-endorsed NCII Code of Practice for banking and finance. Allen & Gledhill
- 22 Jul 2026JPDP opens a PDPA Section 130 investigation into the Maxis customer data disclosure, and MCMC also investigates. Lowyat.NET
- 21 Jul 2026Deputy PM Zahid tells the Dewan Negara online fraud charges reached 8,014 by May 2026, above the 2025 total. The Star
- 20 Jul 2026Dewan Negara passes the Cybercrimes Bill 2026, which repeals the Computer Crimes Act 1997. Bernama
- 1 Jul 2026Dewan Rakyat passes the Cybercrimes Bill 2026. Media Selangor / Bernama
- 26 Jun 2026NACSA issues an NC4 advisory on the Joomla content editor flaw behind government website defacements and urges an update to 2.9.99.6. The Star
- 21 Jun 2026MKN says viral personal data leak claims come from incidents before 2022, and NACSA, MyNIC and JPDP are taking the sites down. FMT / Bernama
- 22 May 2026MCMC publishes the ONSA Child Protection Code and Risk Mitigation Code, effective 1 June. The Star
- 12 Mar 2026Bursa Malaysia says broker-level cyber incidents are contained and orders all brokers and selected vendors to screen their systems. The Star
- 7 Feb 2026NACSA says it is investigating alleged state-aligned espionage against government entities reported by Unit 42. The Star
- 20 Jan 2026BNM imposes RM1 million penalty on Bank Rakyat after an external actor gained unauthorised access to its IT infrastructure (made public 1 April). The Star
- 1 Jan 2026MCMC: Online Safety Act 2025 takes effect, with platforms meeting licensing criteria deemed licensed under CMA s46A. Malay Mail
Incidents
57 of 57 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ ConfirmedSeveral financial institutions | 7 Nov 2026 | Finance | Not disclosed | None | Confirmed. NACSA says it is aware of incidents and NC4 is monitoring. Institutions and incident type not disclosed. MKN on 7 November called them cybersecurity incidents and system disruptions, with BNM leading sector preparedness. | The Star · FMT✓ 8 Nov |
 ✅ ConfirmedBank RakyatKuala LumpurVia a vendorFull story | 6 Nov 2026 | Finance | Defacement | Confirmed. Websites defaced; the bank blames a third-party-managed site and says deposits, data and banking services were unaffected. On 7 November Fahmi Fadzil said the bank blocked the affected server and no data theft had been found so far. Claimed. The actor claims internal access and a data sample, and no sample has been published. Screenshots shared on the night of 6 November show the same MARLANWG message and Session contact ID on both bankrakyat.com.my and the i-Rakyat online banking site, irakyat.com.my. | Malay Mail · Lowyat · Screenshots on X (@Pelabur_Bijak) · Malay Mail✓ 8 Nov | |
 ⚠️ ClaimedMARDEC Bhd | 3 Nov 2026 | Manufacturing | Ransomware | Claimed. Listed on Orova's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedAstino | 2 Nov 2026 | Manufacturing | Ransomware | Claimed. Qilin listed Astino Berhad on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedMalaysia AirlinesSelangorVia a vendorFull story | 31 Oct 2026 | Transport | Supply chain | None | Confirmed. Customer data processed through Amadeus from August 2023 to September 2026 may be exposed. The airline's own systems were not breached. | Malay Mail · Lowyat✓ 7 Nov |
 ✅ ConfirmedRakuten TradeKuala LumpurFull story | 30 Oct 2026 | Finance | Intrusion | None | Confirmed. A cybersecurity attempt took trading offline for over a week; app trading returned on 4 November. No evidence of data loss, per the CEO. Web trading stays suspended for all markets; orders go only through the iSPEED.my app. | The Edge · The Edge✓ 8 Nov |
 ⚠️ ClaimedINTI International University | 30 Oct 2026 | Education | Ransomware | Claimed. Listed on Rhysida's leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedMP Kluang (Kluang council)JohorVia a vendor | 29 Oct 2026 | Government | Intrusion | Confirmed. Eight public LED screens were hijacked to show obscene video and switched off. Police are investigating. Claimed. A Telegram group claimed it, according to foreign outlets. | The Star · Malay Mail✓ 7 Nov | |
| ⚠️ ClaimedAntah HealthCare | 27 Oct 2026 | Health | Ransomware | Claimed. Listed on Crypto24's leak site, which claims 700GB. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMISC GroupKuala Lumpur | 26 Oct 2026 | Transport | Ransomware | Claimed. Listed on Rhysida's leak site, which claims crew data and vessel system credentials. | DeXpose✓ 7 Nov | |
 ⚠️ ClaimedMah Sing GroupKuala LumpurVia a vendor | 26 Oct 2026 | Property | Data leak | Claimed. Claims 1TB from the company's Salesforce instance, including about 1.08 million customer accounts. | ThreatMon✓ 7 Nov | |
 ✅ ConfirmedDewan Bahasa dan PustakaKuala Lumpur | 19 Oct 2026 | Government | SEO poisoning | None | Confirmed. dbp.gov.my subdomains were hijacked to serve gambling pages. NACSA says it is aware of the campaign. | Malaysiakini✓ 7 Nov |
 ⚠️ ClaimedPengurusan Aset Air Bhd | 18 Oct 2026 | Government | Ransomware | Claimed. Listed on Qilin's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedOCK Group | 17 Oct 2026 | Telecom | Ransomware | Claimed. LockBit 5 listed ock.com.my with an estimated attack date of 16 October. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedRoyal Malaysian Customs (JKDM)Putrajaya | 15 Oct 2026 | Government | Access for sale | Claimed. Access to a webshell and production databases offered for US$1,500 on a crime forum. No statement from Customs. | VECERT✓ 7 Nov | |
 ✅ ConfirmedLembaga Tabung HajiKuala LumpurFull story | 8 Oct 2026 | Finance | Intrusion | None | Confirmed. Services suspended for four days after suspicious activity. Police, NACSA and the data protection department notified; savings and data said to be safe. | Malay Mail · The Star✓ 7 Nov |
 ⚠️ ClaimedRoyal Selangor | 5 Oct 2026 | Retail | Ransomware | Claimed. Listed on Byod's leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedCTOS DigitalKuala Lumpur | 23 Sep 2026 | Finance | Intrusion | None | Confirmed. CTOS told Bursa it detected unauthorised access to an environment supporting its consumer business and that files with a limited subset of processed consumer information were accessed. | The Star✓ 7 Nov |
 ✅ ConfirmedDuopharma BiotechSelangor | 11 Sep 2026 | Health | Data leak | None | Confirmed. Duopharma told Bursa that data files allegedly including personal data were extracted after an unauthorised access attempt and that it will notify the Personal Data Protection Commissioner. | The Star✓ 7 Nov |
 ✅ ConfirmedPort of Tanjung PelepasJohorFull story | 10 Sep 2026 | Transport | Ransomware | Confirmed. A cyber incident halted terminal operations overnight; systems were isolated and restored. Claimed. Direwolf listed the port on its leak site and claims ransomware and data theft. | The Loadstar · ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedCIMB SecuritiesKuala Lumpur | 31 Aug 2026 | Finance | Ransomware | Claimed. cimbsecurities.com listed on INC Ransom's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedEP Manufacturing (EPMB) | 31 Aug 2026 | Manufacturing | Ransomware | Claimed. The Gentlemen listed EP Manufacturing Bhd on its leak site. | ransomware.live (Malaysia map)✓ 7 Nov | |
 ⚠️ ClaimedCareClinics | 29 Aug 2026 | Health | Ransomware | Claimed. Qilin listed the CareClinics primary care network on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMalaysian Nuclear Agency (Nuklear Malaysia)Selangor | 30 Jul 2026 | Government | Ransomware | Claimed. The Gentlemen listed the Malaysian Nuclear Agency with an estimated attack date of 29 July. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSunway BerhadSelangor | 23 Jul 2026 | Property | Ransomware | Claimed. Qilin listed Sunway Berhad (sunway.com.my) on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedMaxisKuala Lumpur | 22 Jul 2026 | Telecom | Data leak | Unnamed individual (unauthorised internal access) | Confirmed. Maxis said a customer's billing and account data was exposed through unauthorised actions by an identified person, and JPDP opened an investigation under Section 130 of the PDPA. | Lowyat.NET · Malay Mail✓ 7 Nov |
| ✅ ConfirmedFlexi Parking (LITS), 64 local councilsVia a vendorFull story | 29 Jun 2026 | Other | Intrusion | None | Confirmed. The Selangor government confirmed a cyberattack on the Flexi Parking system and told councils to suspend summonses, and LITS said an intruder reached a legacy server and caused a 61-hour outage. Claimed. The attacker claimed access to data on seven million users, which LITS disputes. | The Star (StarMetro) · Malay Mail✓ 7 Nov |
 ✅ ConfirmedMinistry of Health (KKM)Putrajaya | 27 Jun 2026 | Health | Defacement | Confirmed. The Health Ministry said early findings tied the portal outage to a suspected cyberattack and urged the public to use its verified channels while the site was offline. Claimed. A group calling itself Mushr00w left a message on the defaced page. | The Star · The Star✓ 7 Nov | |
| ✅ ConfirmedCo-operative Societies Commission (SKM) | 26 Jun 2026 | Government | Defacement | None | Confirmed. NACSA said several government websites including SKM were hacked through a flaw in a Joomla content editor extension. | The Star✓ 7 Nov |
 ✅ ConfirmedKraftangan MalaysiaKuala Lumpur | 26 Jun 2026 | Government | Defacement | None | Confirmed. NACSA named the Handicraft Development Corporation among government websites hacked through the Joomla content editor flaw. | The Star✓ 7 Nov |
 ✅ ConfirmedWomen's Development Department (JPW)Putrajaya | 26 Jun 2026 | Government | Defacement | None | Confirmed. NACSA named the Women's Development Department among government websites hacked through the Joomla content editor flaw. | The Star✓ 7 Nov |
 ⚠️ ClaimedSGS Malaysia | 20 Jun 2026 | Other | Ransomware | Claimed. The Gentlemen listed SGS Malaysia with an estimated attack date of 18 June. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedIntellectual Property Corporation of Malaysia (MyIPO)Kuala Lumpur | 13 Jun 2026 | Government | Ransomware | Claimed. Payload listed myipo.gov.my on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedUiTM HoldingsSelangor | 11 Jun 2026 | Education | Ransomware | Claimed. The Gentlemen listed UiTM Holdings, the investment arm of UiTM, with an estimated attack date of 10 June. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedUniversity of Nottingham MalaysiaSelangor | 9 Jun 2026 | Education | Data leak | Confirmed. The university said the incident on its UK-based student records system was contained, a forensic investigation was under way and affected students and alumni were told directly. Claimed. ShinyHunters claimed more than 40 GB including billing, payment and student finance records from the UK, Malaysia and China campuses. | Free Malaysia Today✓ 7 Nov | |
 ⚠️ ClaimedMajlis Perbandaran Alor GajahMelaka | 17 May 2026 | Government | Ransomware | Claimed. Qilin listed the Alor Gajah municipal council on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPNSB Insurance Brokers | 17 May 2026 | Finance | Ransomware | Claimed. Qilin listed PNSB Insurance Brokers Sdn Bhd on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedKeretapi Tanah Melayu (KTMB)Kuala Lumpur | 6 May 2026 | Transport | Ransomware | Claimed. The Gentlemen listed KTMB (ktmb.com.my) with an estimated attack date of 3 May. | ransomware.live✓ 7 Nov | |
 🚫 DisputedOCBC Bank (Malaysia) | 4 May 2026 | Finance | Data leak | Unnamed forum actor | Claimed. A forum actor posted a sample said to hold OCBC Malaysia customer data, and OCBC said the data is fabricated and is not its customer data. | Lowyat.NET✓ 7 Nov |
 🚫 DisputedUOB Malaysia | 4 May 2026 | Finance | Data leak | Unnamed forum actor | Claimed. A forum actor posted a small sample said to be UOB Malaysia account data, and UOB said the claims are false and no customer data was breached. | Lowyat.NET✓ 7 Nov |
| ⚠️ ClaimedKerjaya Prospek Group | 27 Mar 2026 | Property | Ransomware | Claimed. Qilin listed Kerjaya Prospek Group on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedMalacca SecuritiesMelakaVia a vendor | 19 Mar 2026 | Finance | Intrusion | None | Confirmed. Bursa Malaysia said Malacca Securities reported a cybersecurity incident on 19 March involving a specific system component, and the broker suspended Malaysian trading on its M+Global channels from 24 March. | The Edge Malaysia✓ 7 Nov |
| ✅ ConfirmedBursa stockbrokers (UOB Kay Hian, Phillip Capital, Hong Leong IB)Kuala LumpurVia a vendor | 12 Mar 2026 | Finance | Intrusion | None | Confirmed. Bursa Malaysia said a few brokers reported cybersecurity incidents in their own system components that were contained, with no evidence of unauthorised trading or financial loss. Claimed. An unnamed source told The Edge the problem was traced to a trading platform vendor. | The Star · The Edge Malaysia · The Edge Malaysia✓ 7 Nov |
| 🚫 DisputedCIMB BankKuala Lumpur | 4 Mar 2026 | Finance | Data leak | Unnamed X account | Claimed. An X account claimed 1.2 million CIMB customer records, and CIMB said on X the allegation is false and its systems are secure. | Lowyat.NET✓ 7 Nov |
 ⚠️ ClaimedOmesti | 3 Mar 2026 | Other | Ransomware | Claimed. Qilin listed Omesti Berhad on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedLam Soon Group | 3 Mar 2026 | Manufacturing | Ransomware | Claimed. Qilin listed Lam Soon Group on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedMalaysian Army and ministry databases | 26 Feb 2026 | Government | Data leak | Claimed. A forum seller listed records of 14,816 army personnel for US$2,500 and databases tied to five government bodies, and Fahmi Fadzil said his ministry had received no official report of a breach. | Lowyat.NET✓ 7 Nov | |
| ⚠️ ClaimedMalaysia AirlinesSelangor | 26 Feb 2026 | Transport | Ransomware | Claimed. Qilin listed Malaysia Airlines on its leak site without data samples, separate from the later Amadeus incident. | ransomware.live · SC Media✓ 7 Nov | |
 ⚠️ ClaimedWCT Holdings | 11 Feb 2026 | Property | Ransomware | Claimed. The Gentlemen listed WCT Holdings Berhad on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedGovernment ministries and a microloan lender (espionage) | 7 Feb 2026 | Government | Intrusion | Response. NACSA said it has been investigating alleged cyber espionage against various government entities since September 2025 and has found no adverse impact so far. Claimed. Palo Alto Networks Unit 42 alleged that a state-aligned group operating out of Asia compromised several ministries and departments to steal immigration and economic intelligence data. | The Star✓ 7 Nov | |
 ⚠️ ClaimedPLUS MalaysiaSelangor | 6 Feb 2026 | Transport | Ransomware | Claimed. The Gentlemen listed the highway operator on 6 February and Qilin listed it again on 1 March. | ransomware.live (The Gentlemen) · ransomware.live (Qilin)✓ 7 Nov | |
 ⚠️ ClaimedPrince Court Medical CentreKuala Lumpur | 5 Feb 2026 | Health | Data leak | Claimed. 0APT claimed a 1.5 TB leak from the private hospital. | Breachsense✓ 7 Nov | |
 ⚠️ ClaimedKontena Nasional | 20 Jan 2026 | Transport | Ransomware | Claimed. Qilin and The Gentlemen each listed Kontena Nasional Berhad on their leak sites on the same day. | ransomware.live (Qilin) · ransomware.live (The Gentlemen)✓ 7 Nov | |
 ⚠️ ClaimedPerdana Petroleum | 13 Jan 2026 | Energy | Ransomware | Claimed. DireWolf listed Perdana Petroleum Berhad on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedREDtone | 11 Jan 2026 | Telecom | Ransomware | Claimed. Obscura listed REDtone on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSunzen Biotech | 4 Jan 2026 | Health | Ransomware | Claimed. DireWolf listed Sunzen Biotech Berhad on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedBina DarulamanKedah | 4 Jan 2026 | Property | Ransomware | Claimed. DireWolf listed Bina Darulaman Berhad on its leak site. | ransomware.live✓ 7 Nov |
FAQ
What is Malaysia's national cyber threat level?
Medium, since 4 Nov 2026 · was Low. Raised as a precaution over regional and international tensions. No attack was announced with it. Critical infrastructure (NCII) operators apply nine preparedness measures, including 24-hour monitoring, patching, MFA and updated continuity plans. NCII sector heads file weekly threat status reports to NACSA.
Which organisations in Malaysia confirmed cyber incidents recently?
19 incidents confirmed since January 2026: Several financial institutions, Bank Rakyat, Malaysia Airlines, Rakuten Trade, MP Kluang (Kluang council), Dewan Bahasa dan Pustaka, Lembaga Tabung Haji, CTOS Digital, Duopharma Biotech, Port of Tanjung Pelepas, Maxis and Flexi Parking (LITS), 64 local councils and others.
Which Malaysia organisations appear on ransomware or leak sites?
38 claims, not confirmed by the organisations: MARDEC Bhd, Astino, INTI International University, Antah HealthCare, MISC Group, Mah Sing Group, Pengurusan Aset Air Bhd and OCK Group and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.