Bank Rakyat Cyberattack: Minister Says Hackers Defaced a Third-Party Site but Took No Data
Bank Rakyat cyberattack: Malaysia's communications minister says a third-party-managed bank site was hacked and defaced, with no data stolen. The bank blames a supplier's technical problem.
Hackers took over a Bank Rakyat website but stole no data and didn't disrupt online banking, Malaysia's communications minister Fahmi Fadzil said in Doha on 7 November. Bank Rakyat reported that its "third-party-managed website had been hacked", he said.
On the night of 6 November an actor calling itself Marlanwg defaced several Bank Rakyat pages and claimed access to the bank's internal systems.
The bank's version is narrower
Bank Rakyat's own statement, carried by RTM on 7 November, doesn't use the word hack. It says the disruption touched only its corporate website and was caused by a technical problem in a third-party service provider's system. Customers' personal data, banking details and savings were not affected, the bank says. Neither the bank nor the minister addressed Marlanwg's claim of internal access. Fahmi added that the bank had blocked access to the affected server and sent users to the iRakyat site, which the bank fully owns. He also said "non-state actors" had tried other attacks on Malaysian targets, without naming any.
Anwar asks for a wider review
At the 6 November Cabinet meeting, Prime Minister Anwar Ibrahim asked for a fuller review of cybersecurity "across all government assets, banking institutions and government-linked companies", run by the National Cyber Security Agency (NACSA) and the National Security Council. The exercise covers internet infrastructure, websites and databases.
It follows Anwar's warning to Parliament that Malaysia is a potential target. On 4 November NACSA raised the national cyber threat level from Low to Moderate, Bernama reported. Operators of critical national infrastructure now have nine preparedness actions to carry out, and each sector head must send NACSA a weekly threat status report.
What customers can use
While the corporate site is restored, Bank Rakyat says banking goes on as normal through the iRakyat portal and app, BRICK, QR2E and the i-bizRAKYAT business portal.
More news
Who Gives A Crap Data Breach: Customer Names and Addresses Exposed Through a Marketing Vendor
Who Gives A Crap data breach: the Australian toilet paper brand says a US marketing software provider exposed customers' names, contact details and spend. No card data or passwords.
Malaysia Cyber Attack: Security Council Confirms Disruptions at Several Financial Institutions, Names None
Malaysia cyber attack: the National Security Council says NACSA is tracking incidents and system disruptions at several financial institutions, names none, and keeps the threat level at Moderate.
BIR Data Leak: Philippine Tax Bureau Opens Probe With DICT, CICC and Police Cybercrime Unit
BIR data leak: the Philippines' Bureau of Internal Revenue is investigating claims that its data was leaked, with DICT, CICC and police, but hasn't said what may have been taken.