NACSA Raised Malaysia’s Cyber Threat Level: What Businesses Should Check
NACSA raised Malaysia’s national cyber threat level from Low to Medium on 4 November 2026, then said it was monitoring incidents at several financial institutions. Here is what was officially confirmed, and a checklist for business owners.
Unsure who hosts your website or which vendor can change it? Discuss system ownership, access, and a practical review with our Kuching team.
Information checked on 8 November 2026. Malaysia’s National Cyber Security Agency (NACSA) raised the National Cyber Security Threat Level from Low to Medium on 4 November 2026 as a precaution. On 7 November, NACSA said it is aware of cybersecurity incidents involving several financial institutions and is monitoring the situation with the relevant parties. It also said the situation is under control and that critical services continue to operate.
For business owners, the useful question is not “was every rumour true?” It is: what was officially confirmed, what should staff do this week, and who is responsible for your website and the vendors connected to it?
Concept illustration of a business cybersecurity checklist beside a laptop, servers, a database, and a shield symbol representing a system review.
What NACSA Confirmed
According to a 7 November statement relayed by the National Security Council, NACSA is working with the relevant parties after cybersecurity incidents involving several financial institutions. The National Cyber Coordination and Control Centre (NC4) is monitoring the national situation. The threat level remains at Medium, after being raised from Low on 4 November.
NACSA said the current cybersecurity situation is under control. It is working with sector leads and National Critical Information Infrastructure entities so that threats can be detected and addressed, and so that critical services keep running.
The same statement asked the public not to believe or spread unverified allegations about cyber attacks, including those shared on social media. For verified updates, it pointed people to official government channels, official financial-institution channels, and Bank Rakyat channels. New developments are to be shared through official MKN channels under the Prime Minister’s Department.
A Medium threat level is a preparedness signal. It does not, by itself, mean your company’s systems were breached.
What Was Said About the Bank Rakyat Website
Separately, Communications Minister Datuk Seri Fahmi Fadzil said Bank Rakyat reported that its third-party-managed website had been hacked. He said the incident was limited to web defacement — a change to the website’s appearance — and that Bank Rakyat blocked access to the affected server and redirected users to its own i-Rakyat site.
Fahmi also said hacking attempts detected so far had not resulted in data theft or disruption to the country’s online banking systems, and that online transactions remain safe.
That distinction matters for other businesses too. A public website, a customer portal, and a core business system may be hosted by different parties. An incident on one surface is not automatically an incident on all of them, but it is a reminder to know who hosts each one.
A Checklist for Malaysian Businesses
You do not need to become a security analyst to act on this news. Ask your internal IT person, hosting provider, or website vendor for clear answers:
- Where is our company website hosted, and is any part of it managed by a third party?
- Who can change the site, take it offline, and restore a clean version if the public pages are altered?
- Is multi-factor authentication turned on for website admin, email, cloud apps, and finance tools?
- Are security updates and patches current on the website, servers, and business applications we depend on?
- Have we told staff to ignore unofficial “your bank has been hacked” messages, and to use only official websites and apps they already trust?
- If a vendor hosts a form, booking page, or customer portal for us, what data can that system access?
Keep the answers with your system documentation. A reply that “the website is working” only answers an availability question. You still need to know who owns the site and how quickly it can be recovered.
Watch for Follow-on Phishing
After widely reported cyber incidents, criminals often send emails, WhatsApp messages, or fake login pages that look like they come from a bank or a government agency. Staff should not click unexpected links, share one-time codes, or enter passwords from a message they did not expect. If in doubt, open the official website or app directly, or call a number you already have on file.
Decide Whether This Is a Maintenance Task or a Wider Review
If your website is a simple brochure site with a named vendor, the next step may be a short written confirmation: who hosts it, how it is backed up, and how MFA is handled. A wider review becomes useful when nobody is sure who maintains the site, an old portal still connects to customer or finance data, or several vendors can change production systems without a clear owner.
GreatRise IT Consulting, based in Kuching since 2009, helps Malaysian organisations review business websites, vendor-managed systems, and the workflows connected to them. That can start with a conversation about system ownership, IT consulting in Kuching, or custom software where an old portal needs a clearer, maintainable replacement. Related reading: our PHP2Shell website checklist.
Frequently Asked Questions
Does a Medium threat level mean my business was attacked?
No. It is a national preparedness level. Check your own systems and vendors rather than assuming a headline applies to you.
Was customer banking data stolen in the Bank Rakyat website incident?
The minister said the incident was limited to website defacement, with no data theft and no disruption to online banking. Follow official Bank Rakyat channels for customer updates.
Should we replace our website immediately?
Not automatically. First establish who hosts it, whether it can be taken down and restored quickly, and whether admin access uses multi-factor authentication.
What should I prepare before speaking to GreatRise?
A list of websites and business apps, who maintains each one, and any written confirmation from your vendor or host. Do not send passwords or customer records in the first enquiry.
Need a Clearer Picture of Who Maintains Your Systems?
Use the checklist above with your hosting provider or website vendor. Then talk to GreatRise about system ownership, vendor-managed sites, or a practical improvement project.
