Follow us on Google News
Malaysia has ordered a wider review of cybersecurity safeguards across its critical digital infrastructure after hackers reportedly compromised the website of Bank Rakyat, one of the country’s major financial institutions.
Communications Minister Fahmi Fadzil confirmed on Saturday that the incident involved unauthorised changes to a website managed by an external service provider. He maintained that the country’s banking systems remained secure, with no confirmed theft of customer information or disruption to financial transactions.
The incident emerged late on Friday, November 6, when several Bank Rakyat webpages reportedly displayed unauthorised content. The development has raised questions about security controls at companies responsible for maintaining financial institutions’ websites.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Happened During The Bank Rakyat Cyberattack?
The disruption came to light after users encountered problems accessing Bank Rakyat’s online platforms. A Malaysian technology publication reported that several webpages, including an online banking login page, had been altered during the suspected intrusion.
A hacker using the name MARLANWG reportedly claimed responsibility. However, the identity of the attacker and claims about access to internal systems have not been independently verified.
Bank Rakyat subsequently restricted access to affected webpages while attempting to restore normal operations.
In a statement issued on November 7, the bank attributed the corporate website disruption to a technical problem involving an external service provider. It assured customers that their personal information, banking details and deposits remained unaffected.
Customers were advised to continue using official banking channels, including the iRakyat mobile application and designated business banking services.
The bank’s explanation differs in emphasis from the government’s description of a website compromise. Neither account establishes that attackers gained access to core banking infrastructure.
That distinction matters because a compromised public website does not automatically mean hackers can access customer accounts or transfer money.
Prime Minister Orders Wider Cybersecurity Review
The incident has now attracted attention beyond Bank Rakyat.
Prime Minister Anwar Ibrahim has instructed Malaysia’s National Security Council to examine cybersecurity threats affecting important national infrastructure.
According to Fahmi, the review will consider risks involving government websites, banking institutions, government-linked companies and other digital systems.
The matter was also discussed during a Cabinet meeting on November 6, with particular attention given to strengthening protections for critical information infrastructure.
Malaysia’s National Cyber Security Agency and the National Security Council are expected to play important roles in the wider assessment.
The government has also raised concerns about hybrid threats. These can combine cyberattacks with other disruptive activities, including attempts to interfere with essential public services.
For Malaysia, the immediate challenge is determining whether the Bank Rakyat incident represents an isolated website compromise or exposes weaknesses that could affect other institutions using external technology providers.
Officials have not publicly identified a broader coordinated campaign linked to this particular incident.
What Is Website Defacement And Why Does It Matter?
The Bank Rakyat incident involves a technical concept known as website defacement.
In simple terms, website defacement happens when an unauthorised person changes what visitors see on a website. It is similar to someone replacing an official signboard with an unauthorised message.
Such attacks can damage public confidence, particularly when the affected website belongs to a bank.
However, changing a website’s appearance is different from entering a bank’s transaction-processing system or stealing money from customer accounts.
Another important issue is third-party security.
Banks often rely on outside companies to manage websites and other digital services. A weakness in one of these external systems can expose the bank’s public-facing platforms even when its main banking systems remain protected.
Malaysia has faced similar concerns before.
In 2022, a security incident involving payment services provider iPay88 prompted scrutiny from Bank Negara Malaysia, the country’s central bank.
The regulator subsequently required the company to strengthen its cybersecurity controls following an independent investigation. At the time, it distinguished weaknesses in the payment provider’s systems from the security of banks themselves.
What Remains Unclear About The Attack?
Despite official assurances, several questions remain unanswered.
Authorities have not publicly disclosed the precise method used to compromise the affected website, the complete findings of a forensic investigation or whether any additional systems were accessed.
There is also no independently verified evidence that customer funds were stolen during the incident.
The next important development will be whether Malaysia’s cybersecurity review identifies shortcomings in third-party security arrangements and recommends stronger safeguards across the financial sector.
For now, the reported website compromise and the government’s broader security response remain the central developments.
