Malaysian cooperative lender Bank Rakyat has moved to reassure customers that their personal data and savings are safe after its corporate website was taken offline following what appears to have been a cyberattack late on 6 November.
The bank attributed the outage to a technical problem involving a third-party service provider and said its core banking operations were running normally. However, the incident adds to a series of technology-related setbacks that have already drawn regulatory penalties against the institution.
Reported Defacement Claimed by a Threat Actor
Technology news site Lowyat.NET reported that several of Bank Rakyat's webpages were defaced, including the login page for its iRakyat online banking service. A threat actor operating under the name MARLANWG claimed responsibility for the attack.
Following the reports, the bank restricted access to its corporate website on a temporary basis while it dealt with the issue.
Bank Points to a Third-Party Technical Issue
In a statement issued on 7 November, Bank Rakyat confirmed its corporate website was unavailable and linked the disruption to a technical issue at a third-party service provider. It said the problem was confined to the corporate site.
The bank stated that customers' personal details, banking information and savings had not been compromised, and that its banking systems continued to operate as usual.
Notably, the bank's statements did not directly confirm a cyberattack, nor did they address the reported defacement of its pages.
Alternative Channels for Customers
While restoration work continued, Bank Rakyat directed customers to its other digital platforms. These included the iRakyat website and mobile app, BRICK, QR2E and the i-bizRAKYAT portal for business banking clients.
The lender said it would share further updates on the disruption as more information becomes available.
National Cyber Agency Monitoring Developments
According to Lowyat.NET, Malaysia's National Cyber Security Agency (NACSA) was tracking the situation through its National Cyber Coordination and Command Centre. The agency was reportedly monitoring developments involving several financial institutions, not only Bank Rakyat.
That detail suggests authorities are watching for broader activity across the sector, though no further specifics were provided.
A Track Record of Regulatory Penalties
The episode follows enforcement action by Bank Negara Malaysia earlier this year. As reported by Fintech News Malaysia, the central bank imposed a RM1 million penalty on Bank Rakyat on 20 January 2026 for breaches related to cybersecurity and the protection of customer information, announcing the action on 1 April.
That penalty stemmed from an earlier incident in which an external threat actor gained unauthorised access to the bank's IT infrastructure. The regulator found the bank had not met requirements under its Risk Management in Technology (RMiT) policy document.
Separately, in June 2025 the central bank fined Bank Rakyat RM2.85 million over repeated service disruptions between June 2023 and December 2024, along with shortcomings in how it responded to and recovered from those incidents.
What the Incident Signals for Malaysian Finance
Even when core systems are untouched, a defaced public website, particularly one tied to an online banking login page, can erode customer confidence and invite phishing attempts that exploit the confusion.
The bank's reference to a third-party provider also highlights how dependent financial institutions are on external vendors, making supply-chain security a growing focus for banks, fintech firms and the regulators who oversee them.
For Bank Rakyat, the incident will likely sharpen scrutiny of its technology risk controls, given the penalties already on record and the national cyber agency's attention to the wider financial sector.
Source: Fintech News Malaysia
