Bank Kerjasama Rakyat Malaysia Berhad (Bank Rakyat) said on 7 November 2026 that customer deposits, personal data and banking services were unaffected by a disruption to its corporate website that began late on 6 November, which it attributed to a technical problem at a third-party service provider. The incident tests confidence in Malaysia’s digital banking channels at a time when the government has ordered a wider cybersecurity review covering banking institutions.
Key Facts At A Glance
- Bank Rakyat’s corporate website became inaccessible late on 6 November 2026.
- The bank attributed the disruption to a technical issue with a third-party service provider and said customer data, savings and banking operations were unaffected.
- Technology media reported that several Bank Rakyat webpages, including the iRakyat login page, were defaced in a suspected cyberattack.
- Communications Minister Fahmi Fadzil said the third-party-managed website was hacked, but the incident was limited to web defacement.
- Customers were directed to alternative channels: the iRakyat website and app, BRICK, QR2E and i-bizRAKYAT.
- The Prime Minister has called for a broader cybersecurity review across government assets, banking institutions and government-linked companies.
- Bank Negara Malaysia fined Bank Rakyat RM1 million earlier in 2026 for failing to meet cybersecurity requirements.
The disruption was confined to the bank’s corporate website, and its banking systems and operations continued to function normally, according to a statement Bank Rakyat posted on Facebook on 7 November. Customers were advised to continue transacting through the iRakyat website, the iRakyat mobile application, BRICK, QR2E and i-bizRAKYAT while access was restored.
The bank first issued an advisory at about 11.30 pm on 6 November saying its corporate website was temporarily inaccessible. That advisory did not give a cause or a restoration timeline.
Technology media separately reported that several Bank Rakyat banking webpages, including the iRakyat online banking login page, were defaced in a suspected cyberattack late on 6 November. In its own statement, the bank did not confirm a cyberattack and attributed the disruption to a technical issue involving a third-party service provider.
Government Says Banking Systems Remain Secure
Communications Minister Fahmi Fadzil said in Doha on 7 November that Malaysia’s online banking system remained secure despite attempted cyberattacks by non-state actors. He said the attempts detected so far had caused no data theft and no disruption to online banking.
Fahmi said Bank Rakyat had reported that its third-party-managed website was hacked, but the incident was limited to web defacement. According to the minister, the bank blocked access to the affected server and redirected users to the i-Rakyat website, which it fully owns.
Fahmi also said Prime Minister Anwar Ibrahim had directed the National Security Council in the preceding week to review potential threats to national infrastructure, particularly hybrid threats. He added that at the 6 November Cabinet meeting, the Prime Minister called for a more thorough cybersecurity review across government assets, banking institutions and government-linked companies, involving the National Cyber Security Agency and the National Security Council.
Prior Regulatory Penalty
Earlier in 2026, Bank Negara Malaysia fined Bank Rakyat RM1 million for failing to meet cybersecurity requirements and adequately safeguard customer information. That penalty followed an earlier incident in which an external threat actor gained unauthorised access to the bank’s IT infrastructure. The bank has since strengthened its cybersecurity and ICT controls, resources and governance.
Public information on the latest incident remains limited. Bank Rakyat has not named the third-party provider, given a full restoration timeline, or disclosed the findings of any technical review. Customers can contact the Bank Rakyat call centre at 1300 80 5454.