https://pwnsy.com/tools/cyber-watch/malaysia/Sourced cyber incidents and official statements, from pwnsy Cyber Watch.enSun, 08 Nov 2026 00:00:00 +0000https://pwnsy.com/tools/cyber-watch/malaysia/#all9b0e18232cd002dbSat, 07 Nov 2026 00:00:00 +0000NACSA says it is aware of incidents and NC4 is monitoring. Institutions and incident type not disclosed. MKN on 7 November called them cybersecurity incidents and system disruptions, with BNM leading sector preparedness. Sources: https://www.thestar.com.my/tech/tech-news/2026/11/07/nacsa-says-it-is-aware-of-cyber-incidents-involving-financial-institutions-currently-monitoring-developments, https://www.freemalaysiatoday.com/category/nation/2026/11/07/don-t-be-fooled-by-claims-of-cyberattack-says-security-councilhttps://www.thestar.com.my/tech/tech-news/2026/11/07/nacsa-says-it-is-aware-of-cyber-incidents-involving-financial-institutions-currently-monitoring-developments80ae55f53d5133ccSat, 07 Nov 2026 00:00:00 +0000NACSA says it is aware of incidents at several financial institutions and the situation is under control. None named.https://www.thestar.com.my/news/nation/2026/11/07/malaysia039s-online-banking-system-remains-secure-says-comms-minister93afa44315d71e14Sat, 07 Nov 2026 00:00:00 +0000Fahmi Fadzil says non-state actors attempted attacks but no data theft or online banking disruption has occurred, and Bank Rakyat's case was a defacement.https://utusansarawak.com.my/isu-serangan-siber-polis-sarawak-terima-empat-laporan-di-miri/f9f4f5dc357ed634Sat, 07 Nov 2026 00:00:00 +0000Miri police receive four reports of failed ATM cash withdrawals and are checking whether a cyberattack or a technical fault caused them.https://www.mycert.org.my/portal/advisory?id=MA-1500.1120266e81c01c09eb9b80Sat, 07 Nov 2026 00:00:00 +0000MyCERT advisory MA-1500.112026 rates the risk critical for Synology NAS owners: a C3RB3R ransomware wave is mass-encrypting internet-exposed devices through unpatched DSM flaws (CVE-2024-10441), and the Node2Shell Brotli flaw (CVE-2026-111497) is under investigation as another way in. Patch or reinstall within 24 to 48 hours.https://www.freemalaysiatoday.com/category/nation/2026/11/07/don-t-be-fooled-by-claims-of-cyberattack-says-security-council4f5838ecaf493d06Sat, 07 Nov 2026 00:00:00 +0000MKN warns the public against unverified cyberattack claims on social media, keeps the threat level at Medium and says BNM leads financial-sector preparedness.https://pwnsy.com/tools/cyber-watch/malaysia/#alld5a5f4bea59b62b2Fri, 06 Nov 2026 00:00:00 +0000Websites defaced; the bank blames a third-party-managed site and says deposits, data and banking services were unaffected. On 7 November Fahmi Fadzil said the bank blocked the affected server and no data theft had been found so far. The actor claims internal access and a data sample, and no sample has been published. Screenshots shared on the night of 6 November show the same MARLANWG message and Session contact ID on both bankrakyat.com.my and the i-Rakyat online banking site, irakyat.com.my. Sources: https://www.malaymail.com/news/malaysia/2026/11/07/bank-rakyat-blames-third-party-glitch-for-website-outage-says-customer-funds-and-data-safe/242358, https://www.lowyat.net/2026/409395/bank-rakyat-takes-down-sites-after-suspected-cyber-attack/, https://x.com/Pelabur_Bijak/status/2118711569681105127, https://www.malaymail.com/news/malaysia/2026/11/07/fahmi-says-online-banking-remains-safe-despite-cyberattacks-and-bank-rakyat-hack/242378https://www.thestar.com.my/news/nation/2026/11/06/mcmc-on-higher-alert349a4849adde598dFri, 06 Nov 2026 00:00:00 +0000MCMC steps up monitoring; Bank Negara restates RMiT duties; Cabinet orders a review of government, bank and GLC systems.https://pwnsy.com/tools/cyber-watch/incidents/bank-rakyat-website-defacement/6127bb18208a9d1dFri, 06 Nov 2026 00:00:00 +0000Bank Rakyat websites, including the iRakyat login page, were defaced on 6 Nov 2026. What the bank confirmed, what the attacker claims, and what customers should do.https://berita.rtm.gov.my/nasional/senarai-berita-nasional/senarai-artikel/matikan-muat-turun-automatik-whatsapp-telegram-elak-serangan-siber-nacsa/9942a6da6300d757Thu, 05 Nov 2026 00:00:00 +0000NACSA tells users to turn off WhatsApp and Telegram auto-download after .vbs files disguised as financial and legal documents spread via WhatsApp Web.https://www.bernama.com/en/general/news.php?id=2630182846e4961fd5e6b2eWed, 04 Nov 2026 00:00:00 +0000NACSA raises the national threat level from Low to Medium.https://pwnsy.com/tools/cyber-watch/incidents/amadeus-airline-data-breach/8cc6de331900f74eWed, 04 Nov 2026 00:00:00 +0000Eight airlines in six countries confirmed customer data exposure through Amadeus in 2026, including Malaysia Airlines and Singapore Airlines. Dates, figures and sources.https://pwnsy.com/tools/cyber-watch/malaysia/#all5654c3e04e34d10dTue, 03 Nov 2026 00:00:00 +0000Listed on Orova's leak site. Sources: https://www.ransomware.live/map/MYhttps://www.malaymail.com/news/malaysia/2026/11/03/pm-anwar-malaysia-vulnerable-to-sophisticated-cyber-attacks-home-ministry-to-hold-special-meeting-today/24178371723e46e5801736Tue, 03 Nov 2026 00:00:00 +0000PM Anwar tells Parliament Malaysia could be targeted, citing data centres and its stance on Palestine and Gaza.https://pwnsy.com/tools/cyber-watch/malaysia/#all03edb71b7f11067eMon, 02 Nov 2026 00:00:00 +0000Qilin listed Astino Berhad on its leak site. Sources: https://www.ransomware.live/id/QXN0aW5vIEJlcmhhZEBxaWxpbghttps://pwnsy.com/tools/cyber-watch/malaysia/#allb135a7e75fc74eecSat, 31 Oct 2026 00:00:00 +0000Customer data processed through Amadeus from August 2023 to September 2026 may be exposed. The airline's own systems were not breached. Sources: https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516, https://www.lowyat.net/2026/408920/malaysia-airlines-amadeus-data-breach/https://pwnsy.com/tools/cyber-watch/malaysia/#all2f679eeeed65220fFri, 30 Oct 2026 00:00:00 +0000A cybersecurity attempt took trading offline for over a week; app trading returned on 4 November. No evidence of data loss, per the CEO. Web trading stays suspended for all markets; orders go only through the iSPEED.my app. Sources: https://theedgemalaysia.com/node/823904, https://theedgemalaysia.com/node/824498https://pwnsy.com/tools/cyber-watch/malaysia/#all2b1693dc4e47be73Fri, 30 Oct 2026 00:00:00 +0000Listed on Rhysida's leak site. Sources: https://www.ransomware.live/map/MYhttps://pwnsy.com/tools/cyber-watch/incidents/rakuten-trade-outage/34b4e4ea909048caFri, 30 Oct 2026 00:00:00 +0000Rakuten Trade stopped online Bursa Malaysia orders for over a week in October 2026 after a cybersecurity attempt. App trading returned on 4 November.https://pwnsy.com/tools/cyber-watch/malaysia/#alld509aecdd301143aThu, 29 Oct 2026 00:00:00 +0000Eight public LED screens were hijacked to show obscene video and switched off. Police are investigating. A Telegram group claimed it, according to foreign outlets. Sources: https://www.thestar.com.my/news/nation/2026/10/30/police-probing-obscene-content-on-kluang-led-screens, https://www.malaymail.com/news/malaysia/2026/10/31/police-probe-hacking-of-kluang-council-led-screens-after-obscene-content-displayed/241350https://pwnsy.com/tools/cyber-watch/malaysia/#alla82331d7fa5aec0fTue, 27 Oct 2026 00:00:00 +0000Listed on Crypto24's leak site, which claims 700GB. Sources: https://www.ransomware.live/map/MYhttps://www.malaymail.com/news/malaysia/2026/10/27/saifuddin-nasution-rm143m-returned-to-online-scam-victims-rm1009m-losses-prevented/240823e995504ef2d93e8bTue, 27 Oct 2026 00:00:00 +0000Home Minister tells the Dewan Rakyat NSRC recovered only RM14.3 million of RM1.2 billion in reported scam losses.https://pwnsy.com/tools/cyber-watch/malaysia/#allac55c4a760c1e416Mon, 26 Oct 2026 00:00:00 +0000Listed on Rhysida's leak site, which claims crew data and vessel system credentials. Sources: https://www.dexpose.io/rhysida-ransomware-attack-on-misc-group/https://pwnsy.com/tools/cyber-watch/malaysia/#alle175fd483464864aMon, 26 Oct 2026 00:00:00 +0000Claims 1TB from the company's Salesforce instance, including about 1.08 million customer accounts. Sources: https://x.com/MonThreat/status/2117529973120467401https://pwnsy.com/tools/cyber-watch/malaysia/#all457a3404c0420e44Mon, 19 Oct 2026 00:00:00 +0000dbp.gov.my subdomains were hijacked to serve gambling pages. NACSA says it is aware of the campaign. Sources: https://www.malaysiakini.com/news/887446-govt-websites-still-getting-hijacked-by-online-casinoshttps://www.malaysiakini.com/news/887446-govt-websites-still-getting-hijacked-by-online-casinosa27c22b819bf0c6aMon, 19 Oct 2026 00:00:00 +0000NACSA chief Megat Zuhairy says most SEO poisoning incidents on government sites can be mitigated promptly.https://pwnsy.com/tools/cyber-watch/malaysia/#alle8cabd2fc76e2b37Sun, 18 Oct 2026 00:00:00 +0000Listed on Qilin's leak site. Sources: https://www.ransomware.live/map/MYhttps://pwnsy.com/tools/cyber-watch/malaysia/#allc2ffc86364863a7cSat, 17 Oct 2026 00:00:00 +0000LockBit 5 listed ock.com.my with an estimated attack date of 16 October. Sources: https://www.ransomware.live/id/b2NrLmNvbS5teUBsb2NrYml0NQhttps://pwnsy.com/tools/cyber-watch/malaysia/#all1ffd0d144ac59eafThu, 15 Oct 2026 00:00:00 +0000Access to a webshell and production databases offered for US$1,500 on a crime forum. No statement from Customs. Sources: https://x.com/VECERTRadar/status/2112747404151640104https://pwnsy.com/tools/cyber-watch/malaysia/#all89481af1b1fdf326Thu, 08 Oct 2026 00:00:00 +0000Services suspended for four days after suspicious activity. Police, NACSA and the data protection department notified; savings and data said to be safe. Sources: https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782, https://thestar.com.my/tech/tech-news/2026/10/08/tabung-haji-suspends-services-after-detecting-suspicious-cyber-activityhttps://pwnsy.com/tools/cyber-watch/incidents/tabung-haji-cyberattack/45e7de37b420ff7eThu, 08 Oct 2026 00:00:00 +0000Tabung Haji paused all channels for four days in October 2026 after a cyberattack. TH says depositors' savings are safe. What happened and what to do.https://mediaselangor.com/en/2026/10/399563c25de5b844b2c4baTue, 06 Oct 2026 00:00:00 +0000BNM Governor says the financial sector blocked RM1.9 billion in attempted fraud in H1 2026.https://pwnsy.com/tools/cyber-watch/malaysia/#all3c56108fde9772cfMon, 05 Oct 2026 00:00:00 +0000Listed on Byod's leak site. Sources: https://www.ransomware.live/map/MYhttps://www.allenandgledhill.com/perspectives/publications/bulletins-malaysia/2026/bank-negara-malaysia-revises-risk-management-in-technology-policy-document/20acf52fc2496e23Fri, 25 Sep 2026 00:00:00 +0000BNM reissues RMiT with a NACSA-endorsed NCII Code of Practice for banking and finance.https://pwnsy.com/tools/cyber-watch/malaysia/#all33c4399f560e3c3fWed, 23 Sep 2026 00:00:00 +0000CTOS told Bursa it detected unauthorised access to an environment supporting its consumer business and that files with a limited subset of processed consumer information were accessed. Sources: https://www.thestar.com.my/business/business-news/2026/09/23/ctos-digital-detects-unauthorised-access-some-consumer-data-affectedhttps://pwnsy.com/tools/cyber-watch/malaysia/#all60c2a77489c85244Fri, 11 Sep 2026 00:00:00 +0000Duopharma told Bursa that data files allegedly including personal data were extracted after an unauthorised access attempt and that it will notify the Personal Data Protection Commissioner. Sources: https://www.thestar.com.my/business/business-news/2026/09/11/duopharma-says-data-files-extracted-in-cyber-incidenthttps://pwnsy.com/tools/cyber-watch/malaysia/#all3d3d1d5999786d1aThu, 10 Sep 2026 00:00:00 +0000A cyber incident halted terminal operations overnight; systems were isolated and restored. Direwolf listed the port on its leak site and claims ransomware and data theft. Sources: https://theloadstar.com/cyber-attack-halts-operations-at-malaysias-tanjung-pelepas-port/, https://www.ransomware.live/id/UG9ydCBvZiBUYW5qdW5nIFBlbGVwYXNAZGlyZXdvbGY=https://pwnsy.com/tools/cyber-watch/incidents/port-of-tanjung-pelepas-cyberattack/2295fbc6ba137ee6Thu, 10 Sep 2026 00:00:00 +0000A cyber incident halted container operations at Port of Tanjung Pelepas on 9 to 10 September 2026. The Direwolf group claims it stole 200 GB.https://pwnsy.com/tools/cyber-watch/malaysia/#all202bc4716f575c3fMon, 31 Aug 2026 00:00:00 +0000cimbsecurities.com listed on INC Ransom's leak site. Sources: https://www.ransomware.live/map/MYhttps://pwnsy.com/tools/cyber-watch/malaysia/#all0a55cba4a284f5e2Mon, 31 Aug 2026 00:00:00 +0000The Gentlemen listed EP Manufacturing Bhd on its leak site. Sources: https://www.ransomware.live/map/MY