Bank Rakyat Confirms Online Banking Safe After Disruption

Bank Rakyat has confirmed that a recent disruption to its official corporate website was confined to third-party infrastructure, leaving core banking operations, customer records, and deposits unaffected. The incident, identified on 7 November 2026, involved a web defacement attack on an external server managed by a third-party vendor rather than a breach of internal banking networks. Communications Minister Datuk Seri Fahmi Fadzil and the National Security Council verified that customer funds, personal data, and online financial transactions remain secure. For Malaysian account holders, the clarification confirms that critical banking channels, including the iRakyat web portal and mobile application, remain safe and accessible for ongoing financial services while remediation continues.

Key Facts

The disruption at Bank Rakyat affected solely its third-party-hosted corporate front-end, with no breach detected across its core transaction infrastructure or retail customer accounts. Regulators and cybersecurity agencies confirmed that online banking systems remain fully protected and under continuous operational surveillance.

Core banking operations, customer records, and financial transactions remained completely secure during the external website disruption.

Were Bank Rakyat Customer Accounts Compromised in the Incident?

Bank Rakyat customer accounts, savings, and personal data were not compromised during the recent incident. The bank verified that the disruption was isolated strictly to its external corporate website, while core banking databases and transaction networks remained fully segregated and functional throughout the technical interruption.

Following the disruption, the financial institution blocked access to the compromised third-party server and redirected visitors directly to the secure iRakyat website. Account holders continued executing transfers, deposits, and bill settlements through unaffected alternate digital channels, including the iRakyat mobile application, BRICK, QR2E, and the i-bizRAKYAT portal.

Customer deposits, account details, and core banking ledgers remained completely uncompromised throughout the external web defacement.

How Did National Cybersecurity Authorities Respond to the Attack?

The Malaysian government responded by confirming that national banking infrastructure remains secure, with Communications Minister Datuk Seri Fahmi Fadzil stating the attack caused neither data theft nor operational downtime. The National Security Council maintained the National Cyber Threat Level at medium, while cybersecurity agencies reinforced active surveillance over key financial institutions.

Through the National Cyber Security Agency, the National Cyber Coordination and Command Centre actively monitors ongoing threats targeting critical financial services. Concurrently, Bank Negara Malaysia is executing comprehensive preparedness measures to ensure continuous monitoring of core information infrastructure, while authorities advised the public against sharing unverified social media rumours.

Malaysia maintained its National Cyber Threat Level at medium as federal agencies implemented coordinated monitoring across the financial sector.

What It Means for Malaysian Buyers

For Malaysian banking customers, the incident requires no suspension of daily transactions, as digital banking services, card settlements, and mobile payments continue functioning normally. Verified channels including iRakyat, BRICK, and QR2E remain operational, with regulatory authorities confirming that customer balances are secure and no credential resets or account freezes are mandated.

Users encountering connection errors on the primary corporate domain should bypass third-party search listings and access verified services directly via official mobile apps or bookmarks. Because national transaction gateways and interbank networks remain stable, consumer banking routines face no systemic impact, requiring only ordinary vigilance against potential phishing attempts.

Malaysian banking users face no operational interruptions and can continue transacting safely across verified official platforms.

Common Questions

Was personal banking data leaked during the Bank Rakyat disruption?

No personal data or banking records were leaked during the disruption. Bank Rakyat confirmed that customer savings and account details remained secure throughout the incident. The defacement affected only an external third-party server hosting the corporate landing page, leaving core banking records uncompromised.

Which Bank Rakyat channels remain operational for financial transactions?

Customers can conduct ongoing financial operations using the iRakyat website and mobile application without disruption. Additional platforms including BRICK, QR2E, and the i-bizRAKYAT business portal remain fully accessible, as traffic from the affected server was immediately redirected to secure, in-house systems.

What is Malaysia's current national cybersecurity threat level?

The National Security Council confirmed that Malaysia's National Cyber Threat Level remains at medium. Critical financial infrastructure continues under active surveillance by the National Cyber Security Agency and Bank Negara Malaysia to identify and neutralise unauthorised intrusion attempts without impacting banking services.

Sources and Methodology

This dispatch synthesises verified official communications released on 7 and 8 November 2026 by Bank Rakyat, Communications Minister Datuk Seri Fahmi Fadzil, and the National Security Council. Technical assessments reflect public statements regarding third-party hosting breaches, confirmed regulatory oversight by Bank Negara Malaysia, and official cybersecurity updates.

All details were cross-referenced against official disclosures published by Bank Rakyat, the Ministry of Communications, and the National Security Council on 8 November 2026.

No currency conversions were required as no retail pricing or financial figures were cited in the primary reporting. Source data was reviewed and verified on 8 November 2026 directly from primary releases published via Lowyat.NET, Bank Rakyat official statements, and National Security Council advisories.