Bank Rakyat Websites Defaced by 'Marlanwg', Which Claims Access to the Bank's Internal Systems

Several websites of Bank Rakyat, the Malaysian cooperative bank, were defaced on the night of 6 November, among them the iRakyat online banking login page; Lowyat.NET captured one defaced page at 10.45pm. The bank then took most of its sites offline. It hasn't said whether anyone broke into its systems or whether customer data was touched.

What the attacker claims

The defacement was signed by an actor calling itself Marlanwg. Its note claims "We have successfully accessed the internal infrastructure and retrieved a sample of your data", Pokde reports, and tells the bank's staff to open talks over the encrypted messenger Session on "data deletion and remediation terms".

No data sample has been published. Nobody outside the attacker has confirmed either claim.

The same name was earlier behind an offer of webshell access to production MySQL databases belonging to the Royal Malaysian Customs Department, Lowyat.NET notes. That claim is unconfirmed too.

A fine for an earlier intrusion

Bank Negara Malaysia fined Bank Rakyat RM1 million on 20 January over cybersecurity and customer-data failures, after an outsider got into its IT systems without authorisation. The central bank blamed that breach on "inadequate cybersecurity controls and incident response".

What Bank Rakyat has said

A Facebook notice the bank posted at about 11.30pm says only that its corporate portal was temporarily inaccessible, Bernama reports, and gives no cause. Until it's back, customers are pointed to the iRakyat mobile app, BRICK, QR2E and the i-bizRAKYAT business portal.